CVE-2009-0336

Katy Whitton BlogIt! stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file containing user credentials via a direct request for database/Blog.mdb. NOTE: some of these details are obtained from third party...

CVE-2009-0334

CVE-2009-0334 describes a SQL injection vulnerability in index.asp of Katy Whitton BlogIt! that allows remote attackers to execute arbitrary SQL commands via the day parameter in an archive action. The issue is reflected in multiple sources (NVD/NVD CVE entry) with a high impact score (7.5, high)...

CVE-2009-0336

BlogIt! is affected. The vulnerability stems from storing the database file (Blog.mdb) under the web root with insufficient access controls, enabling remote attackers to download the credentials database via a direct request. This is a server-side exposure of sensitive user data. The description ...

CVE-2009-0335

Cross-site scripting XSS vulnerability in index.asp in Katy Whitton BlogIt! allows remote attackers to inject arbitrary web script or HTML via the view parameter...

CVE-2009-0337

CVE-2009-0337 affects the BlogIt! application by Katy Whitton, where the vulnerable entry point is index.asp. The issue arises from SQL injection via the (1) month and (2) year parameters, allowing remote attackers to execute arbitrary SQL commands. This is a network-accessible vulnerability with...

Cross site scripting

Cross-site scripting XSS vulnerability in rankup.asp in Katy Whitton RankEm allows remote attackers to inject arbitrary web script or HTML via the siteID parameter...

CVE-2009-0248

Cross-site scripting XSS vulnerability in rankup.asp in Katy Whitton RankEm allows remote attackers to inject arbitrary web script or HTML via the siteID parameter...

CVE-2009-0249

Katy Whitton RankEm stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing credentials via a direct request for database/topsites.mdb...

CVE-2009-0248

Cross-site scripting XSS vulnerability in rankup.asp in Katy Whitton RankEm allows remote attackers to inject arbitrary web script or HTML via the siteID parameter...

CVE-2009-0249

Katy Whitton RankEm stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing credentials via a direct request for database/topsites.mdb...

CVE-2009-0248

CVE-2009-0248 describes a cross-site scripting (XSS) vulnerability in the RankEm application, specifically in the file/function rankup.asp where the vulnerable input is the siteID parameter. An attacker could leverage this to inject arbitrary web script or HTML into victims’ browsers. The provide...

CVE-2009-0249

The CVE-2009-0249 entry concerns Katy Whitton RankEm, where sensitive information is stored under the web root with insufficient access control. A remote attacker can directly request database/topsites.mdb and obtain a credentials-containing database. The underlying issue is improper access contr...

CVE-2008-5588

SQL injection vulnerability in rankup.asp in Katy Whitton RankEm allows remote attackers to execute arbitrary SQL commands via the siteID parameter...

CVE-2008-5589

SQL injection vulnerability in processlogin.asp in Katy Whitton RankEm allows remote attackers to execute arbitrary SQL commands via the 1 txtusername parameter aka username field or the 2 txtpassword parameter aka password field. NOTE: some of these details are obtained from third party...

Sql injection

SQL injection vulnerability in rankup.asp in Katy Whitton RankEm allows remote attackers to execute arbitrary SQL commands via the siteID parameter...

Sql injection

SQL injection vulnerability in processlogin.asp in Katy Whitton RankEm allows remote attackers to execute arbitrary SQL commands via the 1 txtusername parameter aka username field or the 2 txtpassword parameter aka password field. NOTE: some of these details are obtained from third party...

CVE-2008-5589

CVE-2008-5589 describes an SQL injection in processlogin.asp of Katy Whitton RankEm, exploitable via the txtusername or txtpassword fields to execute arbitrary SQL remotely. The root cause is improper input handling allowing concatenation into SQL queries, leading to potential data disclosure or ...

CVE-2008-5588

The CVE-2008-5588 entry documents an SQL injection in rankup.asp of Katy Whitton RankEm, exploitable via the siteID parameter. The underlying issue is improper handling/validation of siteID, enabling remote attackers to execute arbitrary SQL commands. Affected software: RankEm (rankup.asp). Impac...

CVE-2008-5588

SQL injection vulnerability in rankup.asp in Katy Whitton RankEm allows remote attackers to execute arbitrary SQL commands via the siteID parameter...

CVE-2008-5589

SQL injection vulnerability in processlogin.asp in Katy Whitton RankEm allows remote attackers to execute arbitrary SQL commands via the 1 txtusername parameter aka username field or the 2 txtpassword parameter aka password field. NOTE: some of these details are obtained from third party...