CVE-2008-2767: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in search.asp in Xigla Poll Manager XE allows remote authenticated users with administrator role privileges to execute arbitrary SQL commands via the orderby parameter...

CVE-2008-2762: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in search.asp in Xigla Absolute Form Processor XE 4.0 allows remote authenticated administrators to execute arbitrary SQL commands via the orderby parameter...

CVE-2008-2760: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in searchbanners.asp in Xigla Absolute Banner Manager XE 2.0 allows remote authenticated administrators to execute arbitrary SQL commands via the orderby parameter...

CVE-2008-2763: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in search.asp in Xigla Absolute Live Support XE 5.1 allows remote authenticated administrators to execute arbitrary SQL commands via the orderby parameter...

CVE-2008-2038

Multiple SQL injection vulnerabilities in admin/adminindex.php in Turnkey Web Tools SunShop Shopping Cart 4.1.0 allow remote authenticated administrators to execute arbitrary SQL commands via the 1 orderby and 2 sort parameters. NOTE: the provenance of this information is unknown; the details are...

CVE-2008-2038: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in admin/adminindex.php in Turnkey Web Tools SunShop Shopping Cart 4.1.0 allow remote authenticated administrators to execute arbitrary SQL commands via the 1 orderby and 2 sort parameters. NOTE: the provenance of this information is unknown; the details are...

CVE-2008-1896

Multiple cross-site scripting XSS vulnerabilities in Carbon Communities 2.4 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 Redirect parameter to login.asp and the 2 OrderBy parameter to membersend.asp...

CVE-2008-1896: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Carbon Communities 2.4 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 Redirect parameter to login.asp and the 2 OrderBy parameter to membersend.asp...

CVE-2006-6181

Multiple SQL injection vulnerabilities in default.asp in ClickTech ClickContact allow remote attackers to execute arbitrary SQL commands via the 1 AlphaSort, 2 In, and 3 orderby parameters...

CVE-2006-6181

CVE-2006-6181 refers to multiple SQL injection vulnerabilities in default.asp of ClickTech ClickContact. The issue allows remote attackers to execute arbitrary SQL commands via the (1) AlphaSort, (2) In, and (3) orderby parameters, indicating a failure to sanitize user input in query construction...

CVE-2006-6187: Undefined Security Weakness

Multiple SQL injection vulnerabilities in ClickTech Click Gallery allow remote attackers to execute arbitrary SQL commands via the 1 currentpage or 2 galleryid parameter to a viewgallery.asp, the 3 imageid parameter to b downloadimage.asp, the currentpage or 5 orderby parameter to c gallery.asp, ...

CVE-2006-6181: Undefined Security Weakness

Multiple SQL injection vulnerabilities in default.asp in ClickTech ClickContact allow remote attackers to execute arbitrary SQL commands via the 1 AlphaSort, 2 In, and 3 orderby parameters...

CVE-2006-4852

SQL injection vulnerability in browse.asp in QuadComm Q-Shop 3.5 allows remote attackers to execute arbitrary SQL commands via the OrderBy parameter...

CVE-2006-4852

SQL injection vulnerability in browse.asp in QuadComm Q-Shop 3.5 allows remote attackers to execute arbitrary SQL commands via the OrderBy parameter...

CVE-2006-4852: Undefined Security Weakness

SQL injection vulnerability in browse.asp in QuadComm Q-Shop 3.5 allows remote attackers to execute arbitrary SQL commands via the OrderBy parameter...

CVE-2005-4608: Undefined Security Weakness

SQL injection vulnerability in index.php in BugPort 1.147 allows remote attackers to execute arbitrary SQL commands via the 1 devWherePair0, 2 orderBy, and 3 where parameters...

lyris-listmanager.txt

Title: Lyris ListManager Multiple Flaws Release Date: December 8, 2005 Patch Date: Unknown v8.9b resolves most issues Reported Date: June 21, 2005 Vendor: Lyris Systems Affected: Lyris ListManager v5.0-8.8a most flaws Summary: The Lyris ListManager software is vulnerable to numerous SQL injection...

CVE-2005-4144: Undefined Security Weakness

Lyris ListManager 5.0 through 8.9a allows remote attackers to add "ORDER BY" columns to SQL queries via unusual whitespace characters in the orderby parameter, such as 1 newlines and 2 0xFF ASCII 255 characters, which are interpreted as whitespace...

CVE-2004-2000: Undefined Security Weakness

SQL injection vulnerability in the Downloads module in Php-Nuke 6.x through 7.2 allows remote attackers to execute arbitrary SQL via the 1 orderby or 2 sid parameters to modules.php...