CVE-2008-4889

CVE-2008-4889 describes a SQL injection in the DZCP (deV!L'z Clanportal) 1.4.9.6 and earlier, triggered in the addbuddy operation via the users parameter in buddys. The vulnerability enables remote attackers with network access and no authentication to execute arbitrary SQL commands, with partial...

CVE-2008-4887: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in index.php in NetRisk 2.0 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter in a 1 profile page profile.php or 2 game page game.php. NOTE: some of these details are obtained from third party information...

CVE-2008-4888: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in error.php in NetRisk 2.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the error parameter to index.php. NOTE: some of these details are obtained from third party information...

CVE-2008-4889: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in index.php in deV!L'z Clanportal DZCP 1.4.9.6 and earlier allows remote attackers to execute arbitrary SQL commands via the users parameter in an addbuddy operation in a buddys action...

CVE-2008-4886: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in index.php in YourFreeWorld Shopping Cart Script allows remote attackers to execute arbitrary SQL commands via the c parameter...

CVE-2008-4804: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the Gallery module 1.3 for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the aid parameter in a showalbum action to index.php. NOTE: some of these details are obtained from third party information. NOTE: this issue was disclosed by an...

ModernBill 4.4.x - Cross-Site Scripting Remote File Inclusion

ModernBill 4.4.x - Cross-Site Scripting Remote File Inclusion ModernBill .:. Client Billing System - User Login ModernBill = v4.4.X Remote File Inclusion Vulnerability and xss by nigh7f411 http://xc0r3.net/ plezz go to ttp://xc0r3.net/forums/ rfi...

CVE-2008-4803: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in index.php in Simple PHP Scripts gallery 0.1, 0.3, and 0.4 allows remote attackers to inject arbitrary web script or HTML via the gallery parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party...

DEBIAN-CVE-2008-4769

Directory traversal vulnerability in the getcategorytemplate function in wp-includes/theme.php in WordPress 2.3.3 and earlier, and 2.5, allows remote attackers to include and possibly execute arbitrary PHP files via the cat parameter in index.php. NOTE: some of these details are obtained from thi...

CVE-2008-4769

Directory traversal vulnerability in the getcategorytemplate function in wp-includes/theme.php in WordPress 2.3.3 and earlier, and 2.5, allows remote attackers to include and possibly execute arbitrary PHP files via the cat parameter in index.php. NOTE: some of these details are obtained from thi...

CVE-2008-4769

Directory traversal vulnerability in the getcategorytemplate function in wp-includes/theme.php in WordPress 2.3.3 and earlier, and 2.5, allows remote attackers to include and possibly execute arbitrary PHP files via the cat parameter in index.php. NOTE: some of these details are obtained from thi...

Cross site scripting

Cross-site scripting XSS vulnerability in index.php in iPei Guestbook 2.0 allows remote attackers to inject arbitrary web script or HTML via the pg parameter, a different vector than CVE-2005-4597...

CVE-2008-4743

CVE-2008-4743 is an SQL injection vulnerability in QuidaScript’s FAQ Management Script, specifically in index.php where the catid parameter is used unsafely. The affected component is the index.php handler within the QuidaScript FAQ Management Script, with the underlying cause being improper hand...

CVE-2008-4741: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in index.php in FAR-PHP 1.00, when magicquotesgpc is disabled, allows remote attackers to read arbitrary files via a .. dot dot in the c parameter...

CVE-2008-4743: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in index.php in QuidaScript FAQ Management Script allows remote attackers to execute arbitrary SQL commands via the catid parameter...

CVE-2008-4751: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in index.php in iPei Guestbook 2.0 allows remote attackers to inject arbitrary web script or HTML via the pg parameter, a different vector than CVE-2005-4597...

kasracms-sql.txt

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= KasraCMS index.php Multiple Remote SQL Injection Vulnerabilities -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Script: KasraCMS Language : PHP WebSite:...

Kasra CMS (index.php) Multiple SQL Injection Vulnerabilities

Exploit for unknown platform in category web applications ============================================================ Kasra CMS index.php Multiple SQL Injection Vulnerabilities ============================================================...

MindDezign Photo Gallery 2.2 (index.php id) SQL Injection Vulnerability

No description provided by source. ================================================================================== MindDezign Photo Gallery 2.2 index.php id Remote SQL Injection Vulnerability ==================================================================================...

CVE-2008-4736: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in index.php in RPG.Board 0.8 Beta2 and earlier allows remote attackers to execute arbitrary SQL commands via the showtopic parameter...