SQL injection in Bigware shop software

The Bigware shop software prior to version 2.15 contains a SQL injection, resulting in full database compromise. The injection point is the POST parameter 'lastname' in the module mainbigware43.php. A user must be created before exploitation. Proof of concept is at...

CVE-2006-7078: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in Professional Home Page Tools Login Script, as of July 2006, allow remote attackers to inject arbitrary web script or HTML via the 1 name, 2 vorname, and 3 nachname parameters in the register script. NOTE: some details have been obtained from...

CVE-2006-3111: Undefined Security Weakness

Multiple SQL injection vulnerabilities in main.php in Chipmailer 1.09 allow remote attackers to execute arbitrary SQL commands via multiple parameters, as demonstrated by 1 anfang, 2 name, 3 mail, 4 anrede, 5 vorname, 6 nachname, 7 gebtag, 8 gebmonat, and 9 gebjahr...