CVE-2009-1258

SQL injection vulnerability in the RD-Autos comrdautos component 1.5.7 for Joomla! allows remote attackers to execute arbitrary SQL commands via the makeid parameter in index.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2009-1258

CVE-2009-1258 is a SQL injection vulnerability in the RD-Autos (com_rdautos) Joomla! component, version 1.5.7. The flaw allows remote attackers to execute arbitrary SQL commands via the makeid parameter in index.php. The incident is described with a CVSS 2.0 base score of 7.5 (HIGH) with network ...

CVE-2008-6655

Multiple cross-site scripting XSS vulnerabilities in GEDCOMTOMYSQL 2 allow remote attackers to inject arbitrary web script or HTML via the 1 nombranche and 2 nom parameters to php/prenom.php; the 3 nombranche parameter to php/index.php; and the 4 nombranche, 5 nom, and 6 prenom parameters to...

CVE-2008-6646

Cross-site scripting XSS vulnerability in index.php in CoronaMatrix phpAddressBook 2.0 allows remote attackers to inject arbitrary web script or HTML via the username parameter...

Jinzora name Parameter Local File Inclusion

The remote host is running Jinzora, a web-based media streaming and management system written in PHP. The version of Jinzora installed on the remote host fails to filter user-supplied input to the 'name' variable in the 'index.php' script when 'op' is set before using it to include PHP code...

CVE-2008-6616

CVE-2008-6616 is a cross-site scripting (XSS) vulnerability in Zen Cart 2008, specifically in index.php where the keyword parameter on the advanced_search_result page can inject arbitrary script/HTML. The issue is caused by unsanitized user input that is reflected in the page output. Multiple sou...

CVE-2008-6615

Summary: CVE-2008-6615 describes a SQL injection in Zen Cart 2008 (Zen Software) affecting index.php via the keyword parameter on the advanced_search_result page, allowing remote execution of arbitrary SQL commands. The vulnerability is documented across multiple sources (NVD, CVE lists). The pro...

Sql injection

SQL injection vulnerability in index.php in Minimal ABlog 0.4 allows remote attackers to execute arbitrary SQL commands via the id parameter...

CVE-2008-6611

SQL injection vulnerability in index.php in Minimal ABlog 0.4 allows remote attackers to execute arbitrary SQL commands via the id parameter...

CVE-2008-6611

CVE-2008-6611 describes a SQL injection in index.php of Minimal ABlog 0.4, exploitable via the id parameter to execute arbitrary SQL commands. The NVD notes a base score of 7.5 (HIGH) with network attack vector and low complexity, no authentication required, affecting confidentiality, integrity, ...

osCommerce oscid会话固定漏洞

BUGTRAQ ID: 34348 osCommerce是一套基于GNUGPL授权的开源在线购物电子商务解决方案。 当客户端访问OSCommerce网页时，服务器会发送一个cookie，并将该cookie用作所有之后请求的会话cookie。因此，一旦登录成功，所有之后的请求都会用这个cookie来认证用户，这样攻击者就可以劫持会话执行各种非授权操作。 Harald Ponce de Leon OSCommerce 3.0 Beta Harald Ponce de Leon OSCommerce 2.2 厂商补丁： Harald Ponce de Leon...

Code injection

LightNEasy "no database" aka flat version 1.2.2, and possibly SQLite version 1.2.2, allows remote attackers to create arbitrary files via the page parameter to 1 index.php and 2 LightNEasy.php...

Sql injection

SQL injection vulnerability in LightNEasy/lightneasy.php in LightNEasy SQLite 1.2.2 and earlier allows remote attackers to inject arbitrary PHP code into comments.dat via the dlid parameter to index.php...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in LightNEasy "no database" aka flat version 1.2.2, and possibly SQLite version 1.2.2, allow remote attackers to inject arbitrary web script or HTML via the page parameter to 1 index.php and 2 LightNEasy.php...

CVE-2008-6584

html/index.php in TorrentFlux 2.3 allows remote authenticated users to execute arbitrary code via a URL with a file containing an executable extension in the urlupload parameter, which is downloaded by TorrentFlux and can be accessed via a direct request in a html/downloads/ user directory...

CVE-2008-6591

LightNEasy "no database" aka flat version 1.2.2, and possibly SQLite version 1.2.2, allows remote attackers to create arbitrary files via the page parameter to 1 index.php and 2 LightNEasy.php...

CVE-2008-6593

CVE-2008-6593 describes an SQL injection in LightNEasy SQLite 1.2.2 and earlier affecting lightneasy.php. The vulnerability allows remote attackers to inject arbitrary PHP code into comments.dat via the dlid parameter to index.php, due to insufficient input validation in the affected component. T...

CVE-2008-6596

CVE-2008-6596 affects PHCDownload 1.1, specifically the admin/index.php component. The vulnerability is a SQL injection via the hash parameter, enabling remote attackers to execute arbitrary SQL commands. Documented impact per the CVE is partial confidentiality, integrity, and availability exposu...

Sql injection

SQL injection vulnerability in index.php in Miniweb 2.0 allows remote attackers to execute arbitrary SQL commands via the username parameter in a login action...

CVE-2009-1225

CVE-2009-1225 concerns Turnkey Ebook Store 1.1, where the index.php search action is vulnerable to XSS through the keywords parameter. The root cause is unsanitized input that allows injection of arbitrary HTML/script. Exploitation details or in-wild status are not provided in the documents, and ...