CVE-2008-2046

CVE-2008-2046 describes a cross-site scripting (XSS) vulnerability in the Softpedia SiteXS CMS 0.1.1 Pre-Alpha. The issue resides in index.php and allows remote attackers to inject arbitrary web script or HTML via the user parameter. Documented impact is partial integrity exposure with no confide...

CVE-2008-2046: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in index.php in Softpedia SiteXS CMS 0.1.1 Pre-Alpha allows remote attackers to inject arbitrary web script or HTML via the user parameter...

CVE-2008-2036

CVE-2008-2036 is a SQL injection vulnerability in dream4 Koobi Pro 6.25, affecting index.php via the poll_id parameter in a poll action. The root cause is unvalidated input leading to arbitrary SQL execution by remote attackers. Exploitation details or in-the-wild status are not provided in the c...

CVE-2008-2036

SQL injection vulnerability in index.php in dream4 Koobi Pro 6.25 allows remote attackers to execute arbitrary SQL commands via the pollid parameter in a poll action...

CVE-2008-2024

CVE-2008-2024 describes a cross-site scripting (XSS) vulnerability in the PHP script index.php of miniBB 2.2 (and possibly earlier) that can be triggered when register_globals is enabled. The issue allows remote attackers to inject arbitrary scripts or HTML via the glang[] parameter in a register...

Sql injection

SQL injection vulnerability in index.php in the PostSchedule 1.0 module for PostNuke allows remote attackers to execute arbitrary SQL commands via the eid parameter in an event action...

CVE-2008-2012: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in index.php in the PostSchedule 1.0 module for PostNuke allows remote attackers to execute arbitrary SQL commands via the eid parameter in an event action...

CVE-2008-2036: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in index.php in dream4 Koobi Pro 6.25 allows remote attackers to execute arbitrary SQL commands via the pollid parameter in a poll action...

CVE-2008-2028: Exposure of Sensitive Information to an Unauthorized Actor

miniBB 2.2, and possibly earlier, when registerglobals is enabled, allows remote attackers to obtain the full path via a direct request to the glang parameter in a registernew action to index.php, which leaks the path in an error message...

CVE-2008-2012

CVE-2008-2012 affects the PostSchedule 1.0 module for PostNuke. A SQL injection in index.php allows remote attackers to modify the database by supplying the eid parameter in an event action. Documented impact: arbitrary SQL execution with a CVSSv2 base score of 7.5 (HIGH). No remediation details ...

CVE-2008-2024: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in index.php in miniBB 2.2, and possibly earlier, when registerglobals is enabled, allows remote attackers to inject arbitrary web script or HTML via the glang parameter in a registernew action...

Unfixed XSS vulnerability at www.ptc-house.com

Security researcher PaPPy, has submitted on 29/04/2008 a cross-site-scripting XSS vulnerability affecting www.ptc-house.com, which at the time of submission ranked 171866 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 29/04/2008. It is current...

CVE-2008-1983

Cross-site scripting XSS vulnerability in Advanced Electron Forum AEF 1.0.6 allows remote attackers to inject arbitrary web script or HTML via the beg parameter in a members action to index.php...

CVE-2008-1975

CVE-2008-1975 describes an SQL injection vulnerability in the E-RESERV 2.1 web application, exploitable via the ID_loc parameter in index.php. The vulnerability allows remote attackers to execute arbitrary SQL commands, as the input is treated unsafely within database queries. Multiple connected ...

CVE-2008-1975: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in index.php in E-RESERV 2.1 allows remote attackers to execute arbitrary SQL commands via the IDloc parameter...

CVE-2008-1983: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Advanced Electron Forum AEF 1.0.6 allows remote attackers to inject arbitrary web script or HTML via the beg parameter in a members action to index.php...

Sql injection

SQL injection vulnerability in index.php in Voice Of Web AllMyGuests 0.4.1 allows remote attackers to execute arbitrary SQL commands via the AMGid parameter in a comments action...

CVE-2008-1961

Voice Of Web AllMyGuests 0.4.1 is affected by CVE-2008-1961: an SQL injection in index.php allows remote attackers to execute arbitrary SQL via the AMG_id parameter in the comments action. Root cause: unsanitized AMG_id input in comments processing leads to query manipulation. No remediation deta...

CVE-2008-1961

SQL injection vulnerability in index.php in Voice Of Web AllMyGuests 0.4.1 allows remote attackers to execute arbitrary SQL commands via the AMGid parameter in a comments action...

CVE-2008-1956: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in index.php in Wikepage Opus 13 2007.2 allows remote attackers to inject arbitrary web script or HTML via the wiki parameter...