CVE-2009-3190

CVE-2009-3190 affects PAD Site Scripts 3.6, with multiple SQL injection vulnerabilities exposed via (1) the search parameter to list.php and (2) the cat parameter to rss.php. The underlying issue allows remote attackers to execute arbitrary SQL commands. The CVSSv2 base score is 7.5 (HIGH) with n...

CVE-2009-3191

CVE-2009-3191 affects PAD Site Scripts 3.6. Multiple cross-site scripting (XSS) vulnerabilities allow remote attackers to inject arbitrary web script or HTML via the cat parameter to rss.php and opml.php. Exploitation is remote and demonstrated in public advisories (e.g., Exploit-DB). The NVD ass...

CVE-2009-1739

PAD Site Scripts 3.6 is vulnerable to an authentication bypass: remote attackers can set the authuser cookie parameter to a valid username and gain privileges as other users, including administrative rights. The vulnerability arises from how the authuser value is trusted for authentication, enabl...