CVE-2008-4772: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in main/main.php in QuestCMS allows remote attackers to execute arbitrary SQL commands via the obj parameter...

CVE-2008-4773: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in main/main.php in QuestCMS allows remote attackers to read arbitrary local files via a .. dot dot in the theme parameter...

CVE-2008-4774: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in main/main.php in QuestCMS allows remote attackers to inject arbitrary web script or HTML via the cx parameter...