CVE-2007-6665: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in admin/login.asp in Netchemia oneSCHOOL allows remote attackers to execute arbitrary SQL commands via the txtLoginID parameter...

Netchemia oneSCHOOL 'login.asp' SQL注入漏洞

Netchemia oneSCHOOL是一款基于ASP的WEB应用程序。 Netchemia oneSCHOOL不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞进行SQL注入攻击，可获得敏感信息或操作数据库。 问题是由于'login.asp'脚本对用户提交的WEB参数处理缺少充分过滤，提交恶意SQL查询作为参数数据，可更改原来的SQL逻辑，获得敏感信息或操作数据库。 Netchemia oneSCHOOL 目前没有解决方案提供： http://www.netchemia.com/ http://sebug.net/exploit/2877/...

CVE-2007-6217: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in login.asp in Irola My-Time aka Timesheet 3.5 allow remote attackers to execute arbitrary SQL commands via the 1 login aka Username and 2 password parameters. NOTE: some of these details are obtained from third party information...

CVE-2007-6091: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in files/login.asp in JiRo's Banner System JBS 2.0, and possibly JiRo's Upload Manager aka JiRo's Upload System or JUS, allow remote attackers to execute arbitrary SQL commands via the 1 Username aka Login or Email or 2 Password field...

CVE-2007-5704: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in CodeWidgets.com Online Event Registration Template allow remote attackers to execute arbitrary SQL commands via the 1 Email Address and 2 Password fields in a login.asp and b adminlogin.asp...

CVE-2007-4762: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in embadmin/login.asp in E-SMARTCART 1.0 allow remote attackers to execute arbitrary SQL commands via the 1 user and 2 pass fields, different vectors than CVE-2007-0092...

CVE-2007-4106

SQL injection vulnerability in login.asp in CodeWidgets Pay Roll - Time Sheet and Punch Card Application With Web Interface allows remote attackers to execute arbitrary SQL commands via the Password parameter...

CVE-2007-4106: Undefined Security Weakness

SQL injection vulnerability in login.asp in CodeWidgets Pay Roll - Time Sheet and Punch Card Application With Web Interface allows remote attackers to execute arbitrary SQL commands via the Password parameter...

CVE-2007-4095

SQL injection vulnerability in BSM Store Dependent Forums 1.02 allows remote attackers to execute arbitrary SQL commands via a Username field in an unspecified component, probably the FrmUserName parameter in login.asp...

CVE-2007-4095: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in BSM Store Dependent Forums 1.02 allows remote attackers to execute arbitrary SQL commands via a Username field in an unspecified component, probably the FrmUserName parameter in login.asp...

CVE-2007-4052: Undefined Security Weakness

Cross-site scripting XSS vulnerability in utilities/login.asp in nukedit 4.9.7 and earlier allows remote attackers to inject arbitrary web script or HTML via the email parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

nukeditXSS.txt

Title : Nukedit Login.ASP Cross-Site Scripting Vulnerability Description : Nukedit is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. Software : http://www.nukedit.com/ Author : d3hydr8 Contact : d3hydr8atgmaildotcom Original...

Unfixed XSS vulnerability at www.pcmercato.it

Security researcher By Encore, has submitted on 06/04/2007 a cross-site-scripting XSS vulnerability affecting www.pcmercato.it, which at the time of submission ranked 1816954 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 06/04/2007. It is...

Sql injection

SQL injection vulnerability in login.asp for tPassword in the Raymond BERTHOU script collection aka RBL - ASP allows remote attackers to execute arbitrary SQL commands via the 1 User and 2 Password parameters...

CVE-2007-0784

The CVE-2007-0784 entry describes a SQL injection in login.asp of the Raymond BERTHOU script collection (RBL - ASP). The vulnerability allows remote attackers to execute arbitrary SQL commands through the User and Password parameters, due to improper handling in the login routine. This is a serve...

CVE-2007-0784

SQL injection vulnerability in login.asp for tPassword in the Raymond BERTHOU script collection aka RBL - ASP allows remote attackers to execute arbitrary SQL commands via the 1 User and 2 Password parameters...

CVE-2007-0784: Undefined Security Weakness

SQL injection vulnerability in login.asp for tPassword in the Raymond BERTHOU script collection aka RBL - ASP allows remote attackers to execute arbitrary SQL commands via the 1 User and 2 Password parameters...

CVE-2007-0798: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in Ublog Reload 1.0.5 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters to 1 login.asp; and allow remote authenticated users to inject arbitrary web script or HTML via unspecified parameters to 2 badword.asp,...

CVE-2007-0575

Multiple SQL injection vulnerabilities in the administrative login page admin/login.asp in ASPCode.net AdMentor allow remote attackers to execute arbitrary SQL commands via the 1 Userid and 2 Password fields...

CVE-2007-0575: Undefined Security Weakness

Multiple SQL injection vulnerabilities in the administrative login page admin/login.asp in ASPCode.net AdMentor allow remote attackers to execute arbitrary SQL commands via the 1 Userid and 2 Password fields...