CVE-2008-1900: Undefined Security Weakness

optionUpdate.asp in Carbon Communities 2.4 and earlier allows remote attackers to edit arbitrary member information via a modified ID field...

Sql injection

Multiple SQL injection vulnerabilities in Carbon Communities 2.4 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 ID parameter to events.asp, the 2 UserName parameter to getpassword.asp, and possibly an unspecified parameter to 3 optionUpdate.asp in an edit action...

CVE-2008-1895: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Carbon Communities 2.4 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 ID parameter to events.asp, the 2 UserName parameter to getpassword.asp, and possibly an unspecified parameter to 3 optionUpdate.asp in an edit action...