PT-2009-6399 · Testlink Team · Testlink

Name of the Vulnerable Software and Affected Versions: TestLink versions prior to 1.8.5 Description: The issue allows remote attackers to inject arbitrary web script or HTML via several parameters, including the req parameter to "login.php", and allows remote authenticated users to inject arbitra...

CVE-2009-2780

Multiple cross-site scripting XSS vulnerabilities in 68 Classifieds 4.1 allow remote attackers to inject arbitrary web script or HTML via the 1 cat parameter to category.php, view parameter to 2 login.php and 3 viewlisting.php, page parameter to 4 searchresults.php and 5 toplistings.php, and 6...

CVE-2009-2142

Multiple SQL injection vulnerabilities in admin/index.asp in Zip Store Chat 4.0 and 5.0 allow remote attackers to execute arbitrary SQL commands via the 1 login and 2 senha parameters...

CVE-2008-6236

SQL injection vulnerability in login.php in Simple Document Management System SDMS 1.1.5 and 1.1.4, and possibly earlier, allows remote attackers to execute arbitrary SQL commands via the login parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in XRMS allow remote attackers to inject arbitrary web script or HTML via 1 the real name field, related to the user list; 2 the target parameter to login.php, 3 the title parameter to activities/some.php, 4 the companyname parameter to...

Sql injection

Multiple SQL injection vulnerabilities in Gallarific Free Edition 1.1 allow remote attackers to execute arbitrary SQL commands via the 1 query parameter to a search.php; 2 gusername and 3 gpassword parameters to b login.php; and the 4 username and 5 password parameters to c gadmin/index.php in a...

CVE-2007-6055

Cross-site scripting XSS vulnerability in c/portal/login in Liferay Portal 4.1.0 and 4.1.1 allows remote attackers to inject arbitrary web script or HTML via the login parameter. NOTE: this issue reportedly exists because of a regression that followed a fix at an unspecified earlier date...

DEBIAN-CVE-2007-5106

Cross-site scripting XSS vulnerability in wp-register.php in WordPress 2.0 allows remote attackers to inject arbitrary web script or HTML via the userlogin parameter...

Sql injection

SQL injection vulnerability in admin/login.php in Wheatblog wB 1.1, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the login parameter...

CVE-2007-3557

SQL injection vulnerability in admin/login.php in Wheatblog wB 1.1, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the login parameter...

CVE-2007-2686

Cross-site scripting XSS vulnerability in index.php in Jetbox CMS 2.1 allows remote attackers to inject arbitrary web script or HTML via the login parameter in a sendpwd task...

CVE-2007-2686

CVE-2007-2686 describes a Cross‑Site Scripting (XSS) vulnerability in Jetbox CMS 2.1. The flaw is in index.php, where an attacker can inject arbitrary web script or HTML via the login parameter in the sendpwd task. Affected product: Jetbox CMS 2.1. Reported impact per sources is XSS with potentia...

Sql injection

Multiple SQL injection vulnerabilities in login.php in pL-PHP beta 0.9 allow remote attackers to execute arbitrary SQL commands via the 1 login or 2 pass parameter...

DEBIAN-CVE-2007-1541

Directory traversal vulnerability in am.pl in SQL-Ledger 2.6.27 only checks for the presence of a NULL %00 character to protect against directory traversal attacks, which allows remote attackers to run arbitrary executables and bypass authentication via a .. dot dot sequence in the login paramete...

CVE-2006-3240

Cross-site scripting XSS vulnerability in classes/ui.class.php in dotProject 2.0.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the login parameter...

PT-2006-4135 · Dotproject · Dotproject

Name of the Vulnerable Software and Affected Versions: dotProject versions 2.0.3 and earlier Description: The issue is related to a cross-site scripting XSS vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML via the login parameter. Recommendations: F...

Sql injection

SQL injection vulnerability in PCPIN Chat 5.0.4 and earlier allows remote attackers to execute arbitrary SQL commands via the username field login parameter to main.php...

Sql injection

Multiple SQL injection vulnerabilities in Calendarix allow remote attackers to execute arbitrary SQL commands via 1 the catview parameter in calfunctions.inc.php and 2 the login parameter in callogin.php. NOTE: the catview vector might overlap CVE-2005-1865...

Sql injection

Multiple SQL injection vulnerabilities in e-moBLOG 1.3 allow remote attackers to execute arbitrary SQL commands via the 1 monthy parameter to index.php or 2 login parameter to admin/index.php. NOTE: some sources have reported item 1 as involving the "monthly" parameter, but this is incorrect...

PT-2006-1384 · Aoblogger · Aoblogger

Name of the Vulnerable Software and Affected Versions: aoblogger version 2.3 Description: The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the username parameter in the "login.php" file. Recommendations: For aoblogger version 2.3, consider restricting acce...