2574 matches found
CVE-2008-5854
CVE-2008-5854 affects myPHPscripts Login Session 2.0: vulnerable is login.php in the User form (ls_user, ls_email) during an ls_register action, enabling stored/reflective XSS by remote attackers to inject arbitrary web script/HTML. The NVD entry confirms the vulnerability and its CVSS base metri...
CVE-2008-5854: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in login.php in myPHPscripts Login Session 2.0 allow remote attackers to inject arbitrary web script or HTML via the 1 lsuser and 2 lsemail parameters aka the User form in an lsregister action. NOTE: some of these details are obtained from third...
Sql injection
SQL injection vulnerability in login.php in DeltaScripts PHP Classifieds 7.5 and earlier allows remote attackers to execute arbitrary SQL commands via the adminusername parameter aka admin field. NOTE: some of these details are obtained from third party information...
CVE-2008-5803
CVE-2008-5803 describes a SQL injection vulnerability in the admin/login.php of E-topbiz Online Store 1.0 . The issue allows remote attackers to execute arbitrary SQL commands through the user parameter (aka username field), potentially impacting data confidentiality and integrity. The NVD entry ...
CVE-2008-5806
CVE-2008-5806 affects DeltaScripts PHP Classifieds 7.5 and earlier: a SQL injection flaw in login.php allows remote attackers to inject arbitrary SQL via the admin_username parameter (aka admin field). The vulnerability stems from unsafely constructed queries in the login handling code. Impact is...
CVE-2008-5806
SQL injection vulnerability in login.php in DeltaScripts PHP Classifieds 7.5 and earlier allows remote attackers to execute arbitrary SQL commands via the adminusername parameter aka admin field. NOTE: some of these details are obtained from third party information...
CVE-2008-5806: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in login.php in DeltaScripts PHP Classifieds 7.5 and earlier allows remote attackers to execute arbitrary SQL commands via the adminusername parameter aka admin field. NOTE: some of these details are obtained from third party information...
CVE-2008-5803: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in admin/login.php in E-topbiz Online Store 1.0 allows remote attackers to execute arbitrary SQL commands via the user parameter aka username field. NOTE: some of these details are obtained from third party information...
Wordpress 2.7.0 admin remote code execution vulnerability-vulnerability warning-the black bar safety net
by Ryatpuretot mail: puretot at gmail dot com team: http://www.80vul.com date: 2008-12-18 Analysis: This vulnerability out in the background: wp-admin/post.php if currentusercan'editpost', $postID if $last = wpcheckpostlock $post-ID $lastuser = getuserdata $last ; $lastusername = $lastuser ?...
CVE-2008-4303: Improper Neutralization of Special Elements used in an SQL Command
Multiple SQL injection vulnerabilities in phpCollab 2.5 rc3, 2.4, and earlier allow remote attackers to execute arbitrary SQL commands via the loginForm parameter to general/login.php, and unspecified other vectors...
CVE-2008-4304: Improper Neutralization of Special Elements used in an OS Command
general/login.php in phpCollab 2.5 rc3 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in unspecified input related to the SSLCLIENTCERT environment variable. NOTE: in some environments, SSLCLIENTCERT always has a base64-encoded string value, which may...
phpCollab: Multiple vulnerabilities
Background phpCollab is a web-enabled groupware and project management software written in PHP. It uses SQL-based database backends. Description Multiple vulnerabilities have been found in phpCollab: rgod reported that data sent to general/sendpassword.php via the loginForm parameter is not...
CVE-2008-5648
DeltaScripts PHP Shop 1.0 is vulnerable to SQL injection in admin/login.php via the admin_username parameter. The underlying issue is an unsafely handled input that allows remote attackers to modify the SQL executed by the application, enabling arbitrary SQL commands. This vulnerability is docume...
CVE-2008-5642
Directory traversal vulnerability in admin/login.php in CMS Made Simple 1.4.1 allows remote attackers to read arbitrary files via a .. dot dot in a cmslanguage cookie...
CVE-2008-5648: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in admin/login.php in DeltaScripts PHP Shop 1.0 allows remote attackers to execute arbitrary SQL commands via the adminusername parameter. NOTE: some of these details are obtained from third party information...
CVE-2008-5642: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal vulnerability in admin/login.php in CMS Made Simple 1.4.1 allows remote attackers to read arbitrary files via a .. dot dot in a cmslanguage cookie...
The Rat CMS Alpha 2 - Authentication Bypass
The Rat CMS Alpha 2 - Authentication Bypass --------------------------------- The Rat Cms Auth By Pass --------------------------------- Autore: x0r Email: [email protected] -------------------------------- Bug In: \login.php $sql = "SELECT userid FROM tblauthuser WHERE userid = '$userId' AND...
The Rat CMS Alpha 2 - Authentication Bypass
--------------------------------- The Rat Cms Auth By Pass --------------------------------- Autore: x0r Email: [email protected] -------------------------------- Bug In: \login.php $sql = "SELECT userid FROM tblauthuser WHERE userid = '$userId' AND userpassword = PASSWORD'$password'"; $result...
phpAddEdit 1.3 Login Bypass
------------------------------------- PhpAddEdit 1.3 Login By Pass ------------------------------------- Found By: x0r Evolution Team Email: [email protected] ------------------------------------- Bug In: Addedit-login.php if !$loginerror // --- Set admin cookie so favorite form field will sho...