CVE-2007-3448: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in index.php in BugMall Shopping Cart 2.5 and earlier allows remote attackers to inject arbitrary web script or HTML via the msgs parameter. NOTE: 4.0.2 and other versions might also be affected...

CVE-2007-3451: Undefined Security Weakness

PHP remote file inclusion vulnerability in admin/index.php in 6ALBlog allows remote authenticated administrators to execute arbitrary PHP code via a URL in the pg parameter...

CVE-2007-3425: Undefined Security Weakness

Directory traversal vulnerability in index.php in phpTrafficA 1.4.2 and earlier allows remote attackers to include arbitrary local files via the lang parameter, a different vector and version than CVE-2007-1076.2...

Sql injection

Multiple SQL injection vulnerabilities in index.php in phpRaider 1.0.0 rc8 allow remote attackers to execute arbitrary SQL commands via the 1 id or 2 type parameter...

Sql injection

SQL injection vulnerability in index.php in pagetool 1.07 allows remote attackers to execute arbitrary SQL commands via the newsid parameter in a pagetoolnews action...

CVE-2007-3402: Undefined Security Weakness

SQL injection vulnerability in index.php in pagetool 1.07 allows remote attackers to execute arbitrary SQL commands via the newsid parameter in a pagetoolnews action...

Simple Invoices Index.PHP SQL注入漏洞

Simple Invoices是一款基于PHP的WEB应用程序。 Simple Invoices不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞进行SQL注入攻击获得敏感信息。 问题是由于'index.php'脚本对用户提交的WEB参数缺少过滤，提交恶意SQL查询作为参数数据，可导致应用程序处理时更改原来的SQL逻辑，攻击者可以获得敏感信息或者操作数据库。 Simple Invoices 20070525 目前没有解决方案提供： http://www.simpleinvoices.org/ ?/ Exploit Name: Simple Invoices 2007 05 25...

CVE-2007-3415: Undefined Security Weakness

Multiple SQL injection vulnerabilities in index.php in phpRaider 1.0.0 rc8 allow remote attackers to execute arbitrary SQL commands via the 1 id or 2 type parameter...

6ALBlog (newsid) Remote SQL Injection Vulnerability

No description provided by source. +By CrackersChild+ Portal.......: 6ALBlog All Versions Download.....: http://down.otand.com/download/code/php/blog/6alblog.rar Author.......: CrackersChild | [email protected] & [email protected] Class........: Remote SQL Injection and Remote File...

Pharmacy System Index.PHP SQL注入漏洞

Pharmacy System是一款基于PHP的WEB应用程序。 Pharmacy System不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞进行SQL注入攻击获得敏感信息。 问题是由于'index.php'脚本对用户提交的WEB参数缺少过滤，提交恶意SQL查询作为参数数据，可导致应用程序处理时更改原来的SQL逻辑，攻击者可以获得敏感信息或者操作数据库。 NetArt Media Pharmacy System 2.0 目前没有解决方案提供： http://www.netartmedia.net/pharmacysystem/...

6ALBlog Index.PHP远程文件包含漏洞

6ALBlog是一款基于PHP的WEB应用程序。 6ALBlog不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB进程权限执行任意命令。 问题是由于'Index.PHP'脚本对用户提交的'pg'参数缺少过滤，提交恶意的远程服务器作为包含对象，可导致以WEB进程权限执行任意PHP代码。 6ALBlog 目前没有详细解决方案提供： http://down.otand.com/download/code/php/blog/ http://www.example.com/admin/index.php?pg=Sh3ll?...

PHPAccounts Index.PHP SQL注入漏洞

PHPAccounts是一款基于PHP的WEB应用程序。 PHPAccounts不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞进行SQL注入攻击获得敏感信息。 问题是由于'Index.PHP'脚本对用户提交的WEB参数缺少过滤，提交恶意SQL查询作为参数数据，可导致应用程序处理时更改原来的SQL逻辑，攻击者可以获得敏感信息或者操作数据库。 PHPAccounts 0.5 目前没有解决方案提供： http://phpaccounts.com/ http://www.example.com/path/index.php?OutgoingTypeID=SQL INJECTION...

Sql injection

Multiple SQL injection vulnerabilities in index.php in PHPAccounts 0.5 allow remote attackers to execute arbitrary SQL commands via the 1 OutgoingTypeID, 2 OutgoingID, 3 ProjectID, 4 ClientID, 5 InvoiceID, or 6 VendorID parameter...

CVE-2007-3345

Multiple SQL injection vulnerabilities in index.php in PHPAccounts 0.5 allow remote attackers to execute arbitrary SQL commands via the 1 OutgoingTypeID, 2 OutgoingID, 3 ProjectID, 4 ClientID, 5 InvoiceID, or 6 VendorID parameter...

CVE-2007-3346

CVE-2007-3346 affects PHPAccounts 0.5, where a directory traversal in index.php enables remote attackers to include arbitrary local files by manipulating the page parameter. The vulnerability stems from improper handling of file path input, leading to potential Local File Inclusion. The impact is...

CVE-2007-3346: Undefined Security Weakness

Directory traversal vulnerability in index.php in PHPAccounts 0.5 allows remote attackers to include arbitrary local files via unspecified manipulations of the page parameter...

CVE-2007-3344: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in netjukebox 4.01b allow remote attackers to inject arbitrary web script or HTML via the 1 albumid, 2 order, 3 sort, 4 filter, and 5 genreid parameters to a index.php; and the 6 url parameter to b ridirect.php. NOTE: the attack also reveals the...

CVE-2007-3345: Undefined Security Weakness

Multiple SQL injection vulnerabilities in index.php in PHPAccounts 0.5 allow remote attackers to execute arbitrary SQL commands via the 1 OutgoingTypeID, 2 OutgoingID, 3 ProjectID, 4 ClientID, 5 InvoiceID, or 6 VendorID parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in index.php in Site@School S@S 2.4.10 allows remote attackers to inject arbitrary web script or HTML via the q parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2007-3272

CVE-2007-3272 affects MiniBB 2.0.5. The vulnerability is a directory traversal in index.php where an attacker can read arbitrary files by manipulating the language parameter in a register action (via ..). Documents do not provide exploitation steps, affected versions beyond 2.0.5, or explicit rem...