CVE-2007-3789: Undefined Security Weakness

SQL injection vulnerability in admin/index.php in Inmostore 4.0 allows remote attackers to execute arbitrary SQL commands via the Password field. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CMScout 1.23 - index.php SQL Injection

CMScout 1.23 - index.php SQL Injection / \ / \ | | | | | | | | | | | / | | | | | | | ' / | | ' \ / \ | | | | || | || | | | \ | | | | / | , |/ /|| ||| |||| / | |/ Program Title CMScout , Bernard, and everyone else at g00ns...

Inmostore 4.0 - index.php SQL Injection

Inmostore 4.0 - index.php SQL Injection source: https://www.securityfocus.com/bid/24884/info Inmostore is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query. A successful exploit could allow an attacker to...

Inmostore 4.0 - 'index.php' SQL Injection

source: https://www.securityfocus.com/bid/24884/info Inmostore is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query. A successful exploit could allow an attacker to compromise the application, access or...

CVE-2007-3682: Undefined Security Weakness

SQL injection vulnerability in index.php in OpenLD 1.2.2 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter...

CVE-2007-3707: Undefined Security Weakness

Directory traversal vulnerability in index.php in CodeIgniter 1.5.3 before 20070628, when enablequerystrings is true, allows remote attackers to read arbitrary files via a .. dot dot in the c parameter...

CVE-2007-3643

CVE-2007-3643 affects AV Arcade 2.1b. The vulnerability arises in admin/index.php where the ava_userid cookie value of 1 grants administrative privileges, enabling remote attackers to perform certain admin actions. The root cause is improper authentication/authorization tied to the ava_userid coo...

CVE-2007-3631

CVE-2007-3631 affects GameSiteScript (gss) 3.1 and earlier. The vulnerability is an SQL injection in index.php triggered via the params parameter due to missing input validation of the id field. This can allow remote attackers to execute arbitrary SQL commands. According to NVD, the CVSS v2 base ...

CVE-2007-3631: Undefined Security Weakness

SQL injection vulnerability in index.php in GameSiteScript gss 3.1 and earlier allows remote attackers to execute arbitrary SQL commands via the params parameter, related to missing input validation of the id field...

CVE-2007-3643: Undefined Security Weakness

admin/index.php in AV Arcade 2.1b grants administrative privileges when the avauserid cookie value is 1, which allows remote attackers to perform certain administrative actions...

CVE-2007-3646: Undefined Security Weakness

SQL injection vulnerability in index.php in FlashGameScript 1.7 and earlier allows remote attackers to execute arbitrary SQL commands via the user parameter in a member action...

moodle-xss.txt

Dear [email protected], 1. MustLive mustlive at websecurity.com dot ua reported crossite scripting vulnerability in Moodle 1.7.1 via search parameter of index.php, example:...

Sql injection

SQL injection vulnerability in the dashboard include/utils/SearchUtils.php in vtiger CRM before 5.0.3 allows remote authenticated users to execute arbitrary SQL commands via the assigneduserid parameter in a Potentials ListView action to index.php...

CVE-2007-3598

index.php in vtiger CRM before 5.0.3 allows remote authenticated users to obtain all users' names and e-mail addresses, and possibly change user settings, via a modified record parameter in a DetailView action to the Users module. NOTE: the vendor disputes the changing of settings, reporting that...

CVE-2007-3598: Undefined Security Weakness

index.php in vtiger CRM before 5.0.3 allows remote authenticated users to obtain all users' names and e-mail addresses, and possibly change user settings, via a modified record parameter in a DetailView action to the Users module. NOTE: the vendor disputes the changing of settings, reporting that...

CVE-2007-3587

MyCMS 0.9.8 and earlier allows remote attackers to gain privileges via the admin cookie parameter, as demonstrated by a post to admin/settings.php that injects PHP code into settings.inc, which can then be executed via a direct request to index.php...

AV Arcade Index.PHP SQL注入漏洞

AV Arcade是一款基于PHP的WEB应用程序。 AV Arcade不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞进行SQL注入攻击获得敏感信息。 问题是由于'Index.PHP'脚本对用户提交的'id'参数缺少过滤，提交恶意SQL查询作为参数数据，可导致应用程序处理时更改原来的SQL逻辑，攻击者可以获得敏感信息或者操作数据库。 AV Scripts AV Arcade 2.1b 目前没有解决方案提供： http://www.avscripts.net/...

CVE-2007-3582: Undefined Security Weakness

SQL injection vulnerability in index.php in SuperCali PHP Event Calendar 0.4.0 allows remote attackers to execute arbitrary SQL commands via the o parameter...

CVE-2007-3555

Cross-site scripting XSS vulnerability in index.php in Moodle 1.7.1 allows remote attackers to inject arbitrary web script or HTML via a style expression in the search parameter, a different vulnerability than CVE-2004-1424...

CVE-2007-3555

Cross-site scripting XSS vulnerability in index.php in Moodle 1.7.1 allows remote attackers to inject arbitrary web script or HTML via a style expression in the search parameter, a different vulnerability than CVE-2004-1424...