11756 matches found
Sql injection
SQL injection vulnerability in index.php in phpRPG 0.8, when magicqutoesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the username parameter. NOTE: some of these details are obtained from third party information...
CVE-2007-6469
SQL injection vulnerability in index.php in phpRPG 0.8, when magicqutoesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the username parameter. NOTE: some of these details are obtained from third party information...
CVE-2007-6466: Improper Neutralization of Special Elements used in an SQL Command
Multiple SQL injection vulnerabilities in index.php in FreeWebshop 2.2.1 allow remote attackers to execute arbitrary SQL commands via 1 the prod parameter in a details action, 2 the cat parameter in a browse list action, or 3 the group parameter in a categories action. NOTE: it was later reported...
CVE-2007-6484: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in index.php in phpRPG 0.8 allows remote attackers to execute arbitrary SQL commands via the password parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...
CVE-2007-6469: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in index.php in phpRPG 0.8, when magicqutoesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the username parameter. NOTE: some of these details are obtained from third party information...
CVE-2007-6469
CVE-2007-6469 affects phpRPG 0.8 with an SQL injection in index.php triggered via the username parameter when magic_quotes_gpc is disabled. Remote attackers could potentially execute arbitrary SQL commands. The public records supplied do not include exploitation details or a confirmed remediation...
CVE-2007-6466
Multiple SQL injection vulnerabilities in index.php in FreeWebshop 2.2.1 allow remote attackers to execute arbitrary SQL commands via 1 the prod parameter in a details action, 2 the cat parameter in a browse list action, or 3 the group parameter in a categories action. NOTE: it was later reported...
CVE-2007-6461: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in index.php in Flyspray 0.9.9 through 0.9.9.3 allow remote attackers to inject arbitrary web script or HTML via 1 the query string in an index action, related to the savesearch JavaScript function; and 2 the details parameter in a details action,...
CVE-2007-6489: Undefined Security Weakness
Multiple cross-site scripting XSS vulnerabilities in Falcon Series One CMS 1.4.3 allow remote attackers to inject arbitrary web script or HTML via the 1 gbmail, 2 gbname, and 3 gbtext parameters in a guestbook action to index.php, and unspecified other vectors...
CVE-2007-6467: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in index.php in MKPortal 1.1 RC1 allows remote attackers to execute arbitrary SQL commands via the ida parameter in a gallery fotoshow action...
CVE-2007-6455: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in index.php in Mambo 4.6.2 allow remote attackers to inject arbitrary web script or HTML via the 1 Itemid parameter in a comfrontpage option and the 2 option parameter...
CVE-2007-6466
CVE-2007-6466 affects FreeWebshop 2.2.1 (and MOG-WebShop based on the same code) with multiple SQL injection vulnerabilities in index.php. The exploitable vectors are: (1) prod parameter in a details action, (2) cat parameter in a browse list action, and (3) group parameter in a categories action...
MOG-WebShop - index.php?group SQL Injection
MOG-WebShop - index.php?group SQL Injection !/usr/bin/perl Indonesian Newhack Security Advisory ------------------------------------ MOG-WebShop = ? - Multiple Remote SQL Injection Vulnerabilities Waktu : Dec 15 2007 11:45AM Software : MOG-WebShop |...
Sql injection
SQL injection vulnerability in index.php in Content Injector 1.53 allows remote attackers to execute arbitrary SQL commands via the id parameter in an expand action...
CVE-2007-6412: Improper Control of Generation of Code
Direct static code injection vulnerability in wiki/index.php in Bitweaver 2.0.0 and earlier, when comments are enabled, allows remote attackers to inject arbitrary PHP code via an editcomments action...
CVE-2007-6397: Improper Limitation of a Pathname to a Restricted Directory
Multiple directory traversal vulnerabilities in index.php in Flat PHP Board 1.2 and earlier allow remote attackers to 1 create arbitrary files via a .. dot dot in the username parameter when registering a user account, and 2 read arbitrary PHP files via a .. dot dot in a the topic parameter in a...
CVE-2007-6399: Undefined Security Weakness
index.php in Flat PHP Board 1.2 and earlier allows remote authenticated users to obtain the password for the current user account by reading the password parameter value in the HTML source for the page generated by a profile action...
CVE-2007-6396: Improper Control of Generation of Code
Direct static code injection vulnerability in index.php in Flat PHP Board 1.2 and earlier allows remote attackers to inject arbitrary PHP code via the 1 username, 2 password, and 3 email parameters when registering a user account, which can be executed by accessing the user's php file for this...
CVE-2007-6394: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in index.php in Content Injector 1.53 allows remote attackers to execute arbitrary SQL commands via the id parameter in an expand action...
