CVE-2009-0728

SQL injection vulnerability in the MyeGallery module for MAXdev MDPro MD-Pro and Postnuke allows remote attackers to execute arbitrary SQL commands via the pid parameter in a showpic action to index.php...

Sql injection

SQL injection vulnerability in the MyeGallery module for MAXdev MDPro MD-Pro and Postnuke allows remote attackers to execute arbitrary SQL commands via the pid parameter in a showpic action to index.php...

CVE-2009-0728

SQL injection vulnerability in the MyeGallery module for MAXdev MDPro MD-Pro and Postnuke allows remote attackers to execute arbitrary SQL commands via the pid parameter in a showpic action to index.php...

CVE-2009-0728

The CVE-2009-0728 issue affects MAXdev MDPro (MD-Pro) with the My_eGallery module. The root cause is improper input filtering of the pid parameter in index.php when module=My_eGallery and do=showpic, enabling a remote SQL injection that can execute arbitrary SQL commands. Exploitation details are...

CVE-2009-0728: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the MyeGallery module for MAXdev MDPro MD-Pro and Postnuke allows remote attackers to execute arbitrary SQL commands via the pid parameter in a showpic action to index.php...

Sql injection

SQL injection vulnerability in index.php in MAXdev MDPro MD-Pro 1.0.76 allows remote attackers to execute arbitrary SQL commands via a "Firefox ID=" substring in a Referer HTTP header...

CVE-2007-5222

SQL injection vulnerability in index.php in MAXdev MDPro MD-Pro 1.0.76 allows remote attackers to execute arbitrary SQL commands via a "Firefox ID=" substring in a Referer HTTP header...

CVE-2007-5222

SQL injection vulnerability in index.php in MAXdev MDPro MD-Pro 1.0.76 allows remote attackers to execute arbitrary SQL commands via a "Firefox ID=" substring in a Referer HTTP header...

CVE-2007-5222: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in index.php in MAXdev MDPro MD-Pro 1.0.76 allows remote attackers to execute arbitrary SQL commands via a "Firefox ID=" substring in a Referer HTTP header...

CVE-2007-5222

CVE-2007-5222 is a SQL injection vulnerability in MAXdev MDPro (MD-Pro) 1.0.76 via a Referer header containing the substring "Firefox ID=", enabling remote attackers to inject arbitrary SQL. The affected component is index.php; root cause is crafted input in Referer header. Impact is partial disc...

Sql injection

SQL injection vulnerability in index.php in MAXdev MDPro MD-Pro 1.0.8x and earlier before 20070720 allows remote attackers to execute arbitrary SQL commands via the topicid parameter in a view action in the Topics module, a different vulnerability than CVE-2006-1676...

CVE-2007-3938

SQL injection vulnerability in index.php in MAXdev MDPro MD-Pro 1.0.8x and earlier before 20070720 allows remote attackers to execute arbitrary SQL commands via the topicid parameter in a view action in the Topics module, a different vulnerability than CVE-2006-1676...

CVE-2007-3938

The CVE-2007-3938 entry concerns MAXdev MDPro (MD-Pro) prior to version 1.0.8x (before 20070720) where the index.php topicid parameter in the Topics module is not properly sanitized. The flaw allows an unauthenticated remote attacker to influence SQL queries executed by topics_userapi.php, potent...

CVE-2007-3938: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in index.php in MAXdev MDPro MD-Pro 1.0.8x and earlier before 20070720 allows remote attackers to execute arbitrary SQL commands via the topicid parameter in a view action in the Topics module, a different vulnerability than CVE-2006-1676...

CVE-2007-3938

SQL injection vulnerability in index.php in MAXdev MDPro MD-Pro 1.0.8x and earlier before 20070720 allows remote attackers to execute arbitrary SQL commands via the topicid parameter in a view action in the Topics module, a different vulnerability than CVE-2006-1676...

Sql injection

SQL injection vulnerability in index.php in MAXdev MDPro 1.0.76 allows remote attackers to execute arbitrary SQL commands via the startrow parameter...

CVE-2007-0623

SQL injection vulnerability in index.php in MAXdev MDPro 1.0.76 allows remote attackers to execute arbitrary SQL commands via the startrow parameter...

CVE-2007-0624

user.php in MAXdev MDPro 1.0.76 allows remote attackers to obtain the full path via a ' quote character, and possibly other invalid values, in the uname parameter in a userinfo operation...

CVE-2007-0624

The CVE-2007-0624 issue affects MAXdev MDPro 1.0.76 (user.php) where the uname parameter in a userinfo operation can be crafted to reveal the server’s full filesystem path by injecting a quote character and possibly other invalid values. The vulnerability could enable information disclosure (part...

CVE-2007-0623

The CVE-2007-0623 entry documents an SQL injection vulnerability in the MAXdev MDPro product, specifically in index.php (version 1.0.76). The root cause is improper handling of the startrow parameter, allowing remote attackers to execute arbitrary SQL commands. The vulnerability affects the web a...