CVE-2008-4997: Improper Link Resolution Before File Access

dfxml-invoice in datafreedom-perl 0.1.7 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/zenity temporary file. NOTE: the vendor disputes this vulnerability, stating that the vector is solely "an EXAMPLE used in the manpage...

DEBIAN-CVE-2007-5372

Multiple SQL injection vulnerabilities in a LedgerSMB 1.0.0 through 1.2.7 and b DWS Systems SQL-Ledger 2.x allow remote attackers to execute arbitrary SQL commands via 1 the invoice quantity field or 2 the sort field...

CVE-2007-5372

Multiple SQL injection vulnerabilities in a LedgerSMB 1.0.0 through 1.2.7 and b DWS Systems SQL-Ledger 2.x allow remote attackers to execute arbitrary SQL commands via 1 the invoice quantity field or 2 the sort field...

CVE-2007-5372: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in a LedgerSMB 1.0.0 through 1.2.7 and b DWS Systems SQL-Ledger 2.x allow remote attackers to execute arbitrary SQL commands via 1 the invoice quantity field or 2 the sort field...

PT-2007-2302 · Local · Local Calendar System

Name of the Vulnerable Software and Affected Versions: local Calendar System version 1.1 Description: The issue allows remote attackers to execute arbitrary PHP code via a URL in the TEMPLATE DIR parameter to files such as showinvoices.php, showmonth.php, showevents.php, retrieveinvoice.php,...

CVE-2006-5110

Cross-site scripting XSS vulnerability in home.php in PHP Invoice 2.2 allows remote attackers to inject arbitrary web script or HTML via the msg parameter, a different vector than CVE-2006-5074. NOTE: the provenance of this information is unknown; the details are obtained from third party...

CVE-2006-5110

CVE-2006-5110 is a Cross-site scripting (XSS) vulnerability affecting PHP Invoice 2.2, specifically in home.php where the msg parameter can be exploited to inject arbitrary script/HTML. This is noted as a different vector from CVE-2006-5074. The provided sources describe the vulnerability generic...

CVE-2006-5110: Undefined Security Weakness

Cross-site scripting XSS vulnerability in home.php in PHP Invoice 2.2 allows remote attackers to inject arbitrary web script or HTML via the msg parameter, a different vector than CVE-2006-5074. NOTE: the provenance of this information is unknown; the details are obtained from third party...

CVE-2006-5074

CVE-2006-5074 is an XSS vulnerability in the PHP Invoice 2.2 package. The issue resides in home.php, where an attacker can inject arbitrary script/HTML via the alert parameter. Connected documents corroborate that the same vulnerability (and variant vector) appears in related records (e.g., CVE-2...

CVE-2006-5074: Undefined Security Weakness

Cross-site scripting XSS vulnerability in home.php in PHP Invoice 2.2 allows remote attackers to inject arbitrary web script or HTML via the alert parameter...

PHP Invoice 2.2 (Billing and client Management) home.php Xss vuln.

description : ------------- PHP Invoice designed to automate your entire account, order, billing, ticket system needs. From displaying your sales content, to ordering, PHP Invoice will handle all your billing and authentication requirements with speed and ease. No Matter Webmaster, Web Designer,...

PHP Invoice 2.2 - home.php Cross-Site Scripting

PHP Invoice 2.2 - home.php Cross-Site Scripting source: https://www.securityfocus.com/bid/20221/info PHP Invoice is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to have arbitrary script co...

PHP Invoice 2.2 - 'home.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/20221/info PHP Invoice is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting use...

SolidState 0.4 - Multiple Remote File Inclusions

SolidState 0.4 - Multiple Remote File Inclusions ::::::::: :::::::::: ::: ::: ::::::::::: ::: :+: :+: :+: :+: :+: :+: :+: +:+ +:+ +:+ +:+ +:+ +:+ +:+ ++ +:+ +++:++ ++ +:+ ++ ++ ++ ++ ++ ++ ++ ++ ++ + + + +++ + + ::::::::::: :::::::::: ::: :::: :::: :+: :+: :+: :+: +:+:+: :+:+:+ +:+ +:+ +:+ +:+ +:...

DRZES Hms 3.2 - Multiple SQL Injections

source: https://www.securityfocus.com/bid/15644/info DRZES HMS is prone to multiple SQL injection vulnerabilities. These issues are due to a lack of proper sanitization of user-supplied input before it is used in SQL queries. Successful exploitation could result in a compromise of the application...

CVE-2005-3845

SQL injection vulnerability in invoices.php in EZ Invoice Inc 2.0 allows remote attackers to execute arbitrary SQL commands via the i parameter. NOTE: the vendor has stated "EZ Invoice, Inc has a patah available. Please email [email protected] and EZI will email you the patch to fix this...

CVE-2005-3845

SQL injection vulnerability in invoices.php in EZ Invoice Inc 2.0 allows remote attackers to execute arbitrary SQL commands via the i parameter. NOTE: the vendor has stated "EZ Invoice, Inc has a patah available. Please email [email protected] and EZI will email you the patch to fix this...

CVE-2005-3845

CVE-2005-3845 describes a SQL injection in invoices.php for EZ Invoice Inc 2.0, exploitable via the i parameter to execute arbitrary SQL commands remotely. The affected component is invoices.php within EZ Invoice Inc 2.0. The vendor notes a patch is available and will be emailed to customers upon...

CVE-2005-3845: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in invoices.php in EZ Invoice Inc 2.0 allows remote attackers to execute arbitrary SQL commands via the i parameter. NOTE: the vendor has stated "EZ Invoice, Inc has a patah available. Please email [email protected] and EZI will email you the patch to fix this...

EZ Invoice Inc™ v 2.0 SQL inj.

EZ Invoice Inc™ v 2.0 SQL inj. Vuln. dicovered by : r0t Date: 25 nov. 2005 Orginal advisory:http://pridels.blogspot.com/2005/11/ez-invoice-inc-v-20-sql-inj.html Vendor:http://www.ezinvoiceinc.com/ affected version:v 2.0 and prior Product description: This software is the easiest way create and...