CVE-2009-1670

user/index.php in TCPDB 3.8 does not require administrative authentication, which allows remote attackers to add admin accounts via unspecified vectors. NOTE: some of these details are obtained from third party information...

CVE-2009-1670

user/index.php in TCPDB 3.8 does not require administrative authentication, which allows remote attackers to add admin accounts via unspecified vectors. NOTE: some of these details are obtained from third party information...

CVE-2009-1670

TCPDB 3.8 is vulnerable to a security bypass where user/index.php does not require administrative authentication, allowing remote attackers to add admin accounts via unspecified vectors. This is documented in multiple sources (NVD entry CVE-2009-1670 and OpenVAS entries) with CVSS base score 7.5 ...

Sql injection

Multiple SQL injection vulnerabilities in admin/login.php in Wright Way Services Recipe Script 5 allow remote attackers to execute arbitrary SQL commands via the 1 username and 2 Password fields, as reachable from admin/index.php...

CVE-2009-1661

SQL injection vulnerability in admin/utopic.php in uTopic 1.0, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the rating parameter to index.php...

Directory traversal

Directory traversal vulnerability in index.php in Dew-NewPHPLinks 2.0 allows remote attackers to read arbitrary files via a .. dot dot in the show parameter...

CVE-2009-1624

Directory traversal vulnerability in index.php in Dew-NewPHPLinks 2.0 allows remote attackers to read arbitrary files via a .. dot dot in the show parameter...

RTWebalbum 1.0.462 (AlbumID) Blind SQL Injection Exploit

Exploit for unknown platform in category web applications ======================================================== RTWebalbum 1.0.462 AlbumID Blind SQL Injection Exploit ======================================================== !/usr/bin/perl...

Sql injection

Multiple SQL injection vulnerabilities in index.php in phPhotoGallery 0.92 allow remote attackers to execute arbitrary SQL commands via the 1 Username and 2 Password fields. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2008-6802

Multiple SQL injection vulnerabilities in index.php in phPhotoGallery 0.92 allow remote attackers to execute arbitrary SQL commands via the 1 Username and 2 Password fields. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in TemaTres 1.0.3 and 1.031 allow remote attackers to inject arbitrary web script or HTML via the 1 search form; 2 expresiondebusqueda, 3 letra, 4 estadoid, and 5 tema parameters to index.php; the 6 PATHINFO to index.php; 7 unspecified parameters...

Sql injection

Multiple SQL injection vulnerabilities in TemaTres 1.0.3 and 1.031, when magicquotesgpc is disabled, allow remote attackers or remote authenticated users to execute arbitrary SQL commands via the 1 mail, 2 password, and 3 letra parameters to index.php; 4 y and 5 m parameters to sobre.php; and the...

CVE-2009-1584

Multiple SQL injection vulnerabilities in TemaTres 1.0.3 and 1.031, when magicquotesgpc is disabled, allow remote attackers or remote authenticated users to execute arbitrary SQL commands via the 1 mail, 2 password, and 3 letra parameters to index.php; 4 y and 5 m parameters to sobre.php; and the...

CVE-2008-6802

Affected product: phPhotoGallery 0.92 (index.php). The CVE describes multiple SQL injection vulnerabilities allowing remote attackers to modify/steal data via the (1) Username and (2) Password fields due to insufficient input sanitization. Exploitation status and practical exploit details are not...

CVE-2009-1584

Multiple SQL injection vulnerabilities in TemaTres 1.0.3 and 1.031, when magicquotesgpc is disabled, allow remote attackers or remote authenticated users to execute arbitrary SQL commands via the 1 mail, 2 password, and 3 letra parameters to index.php; 4 y and 5 m parameters to sobre.php; and the...

CVE-2009-1583

Multiple cross-site scripting XSS vulnerabilities in TemaTres 1.0.3 and 1.031 allow remote attackers to inject arbitrary web script or HTML via the 1 search form; 2 expresiondebusqueda, 3 letra, 4 estadoid, and 5 tema parameters to index.php; the 6 PATHINFO to index.php; 7 unspecified parameters...

CVE-2009-1583

CVE-2009-1583 affects TemaTres 1.0.3 and 1.031, with multiple XSS vulnerabilities (and, per OpenVAS, SQLi in some checks) exposed via several parameters to index.php and sobre.php. Impact described as remote script/HTML injection; no exploitation details are provided in the initial/connected docu...

CVE-2009-1548

SQL injection vulnerability in index.php in BluSky CMS allows remote attackers to execute arbitrary SQL commands via the newsid parameter in a read action...

CVE-2009-1548

The vulnerability CVE-2009-1548 is a SQL injection in BluSky CMS, targeting index.php via the news_id parameter in a read action, allowing remote attackers to execute arbitrary SQL commands. This is described as a SQL injection vulnerability with high impact (partial confidentiality, integrity, a...

CVE-2008-6790

The admin module in MindDezign Photo Gallery 2.2 allows remote attackers to add administrative users and gain privileges via a modified username parameter in an edit account action to index.php...