CVE-2006-1107

Cross-site scripting XSS vulnerability in news.php in NMDeluxe before 1.0.1 allows remote attackers to inject arbitrary web script or HTML via the nick parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in news.php in NMDeluxe before 1.0.1 allows remote attackers to inject arbitrary web script or HTML via the nick parameter...

CVE-2006-1108

NMDeluxe is affected by a SQL injection in news.php via the id parameter, allowing remote attackers to execute arbitrary SQL commands. This vulnerability exists in versions before 1.0.1. Exploitation details are referenced in connected records (eVuln/DOC notes PoC). Remediation: upgrade to versio...

CVE-2006-1107

CVE-2006-1107 concerns NMDeluxe prior to 1.0.1, where the vulnerable script is news.php. The root cause is an XSS flaw in the nick parameter due to insufficient input sanitization, allowing remote attackers to inject arbitrary web script or HTML. Documents across multiple sources confirm the affe...

PT-2006-2135 · Nmdeluxe · Nmdeluxe

Name of the Vulnerable Software and Affected Versions: NMDeluxe versions prior to 1.0.1 Description: The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the id parameter in the "news.php" file. Recommendations: For versions prior to 1.0.1, update to version...

Sql injection

SQL injection vulnerability in news.php in Tony Baird Fantastic News 2.1.1 allows remote attackers to execute arbitrary SQL commands via the page parameter. NOTE: the category vector is already covered by CVE-2005-3846...

CVE-2006-0972

SQL injection vulnerability in news.php in Tony Baird Fantastic News 2.1.1 allows remote attackers to execute arbitrary SQL commands via the page parameter. NOTE: the category vector is already covered by CVE-2005-3846...

CVE-2006-0972

CVE-2006-0972 describes a SQL injection vulnerability in the News.php of the Fantast ic News 2.1.1 application. The flaw allows remote attackers to execute arbitrary SQL commands via the page parameter. The initial entry notes that the category vector is already covered by CVE-2005-3846, but does...

CVE-2005-4615

SQL injection vulnerability in news.php in DapperDesk 3.0.1 and earlier allows remote attackers to execute arbitrary SQL commands via the page parameter...

CVE-2005-3859

PHP remote file inclusion vulnerability in q-news.php in Q-News 2.0 allows remote attackers to execute arbitrary PHP code via a URL in the id parameter...

CVE-2005-3846

SQL injection vulnerability in news.php in Fantastic News 2.1.1 and earlier allows remote attackers to execute arbitrary SQL commands via the category parameter...

CVE-2005-3846

The CVE-2005-3846 entry describes an SQL injection in News.php for Fantastic News 2.1.1 and earlier, exploitable via the category parameter. The underlying issue is unsanitized input being used in an SQL query, allowing remote attackers to execute arbitrary SQL commands. Affected software is list...

CVE-2005-3846

SQL injection vulnerability in news.php in Fantastic News 2.1.1 and earlier allows remote attackers to execute arbitrary SQL commands via the category parameter...

DapperDesk 3.0.x "page" SQL inj.

DapperDesk 3.0.x "page" SQL inj. Vuln. dicovered by : r0t Date: 25 nov. 2005 Orginal advisory:http://pridels.blogspot.com/2005/11/dapperdesk-30x-page-sql-inj.html Vendor:http://www.dapperdesk.com/ affected vesion: 3.0.1 and prior Vuln. Description: Input passed to the "page" parameter in "news.ph...

JPortal Web Portal 2.2.12.3.1 - news.php SQL Injection

JPortal Web Portal 2.2.12.3.1 - news.php SQL Injection source: https://www.securityfocus.com/bid/15324/info JPortal is prone to multiple SQL injection vulnerabilities. These are due to a lack of proper sanitization of user-supplied input before being used in an SQL query. Successful exploitation...

CVE-2005-3408

SQL injection vulnerability in news.php in gCards version 1.43 allows remote attackers to execute arbitrary SQL commands via the limit parameter...

CVE-2005-3408

SQL injection vulnerability in news.php in gCards version 1.43 allows remote attackers to execute arbitrary SQL commands via the limit parameter...

CVE-2005-3408

CVE-2005-3408 : SQL injection in news.php of gCards version 1.43, caused by unsafely using the limit parameter in an SQL query. This enables remote attackers to execute arbitrary SQL commands. The vulnerability is described with a CVSSv2 base score of 7.5 (High) with network attack vector, requir...

CVE-2004-2511

Multiple cross-site scripting XSS vulnerabilities in DCP-Portal 5.3.2 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 the year, 2 month, and 3 day parameters in calendar.php; 4 the cid and 5 url parameters in index.php; 6 the cid parameter in annoucement.php; 7 the...

CVE-2005-3201

SQL injection vulnerability in news.php for Utopia News Pro UNP 1.1.3, when magicquotesgpc is disabled and registerglobals is enabled, allows remote attackers to execute arbitrary SQL via the newsid parameter...