Possible Bug in PHP-Fusion 6.0.204

There is a Bug in The News-System: Post something like: memetata http-equiv = "refresh" content = "1; URL = http://www.google.com" and you'll be redirected to google. Possible Solution: use a recursive function to filter metatags...

PHP-Fusion < 6.00.205 HTML Injection

Binary data 3267.prm...

PHP-Fusion < 6.00.110 Multiple Scripts SQL Injection

The remote version of this software is vulnerable to multiple SQL injection attacks due to its failure to properly sanitize certain parameters. Provided PHP's 'magicquotesgpc' setting is disabled, these flaws allow an attacker to manipulate database queries, which may result in the disclosure or...

CVE-2005-3159

SQL injection vulnerability in messages.php in PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the msgview parameter, a different vulnerability than CVE-2005-3157 and CVE-2005-3158...

CVE-2005-3160

Multiple SQL injection vulnerabilities in photogallery.php in PHP-Fusion allow remote attackers to execute arbitrary SQL commands via the 1 album and 2 photo parameters...

CVE-2005-3161

Multiple SQL injection vulnerabilities in PHP-Fusion before 6.00.110 allow remote attackers to execute arbitrary SQL commands via 1 the activate parameter in register.php and 2 the catid parameter in faq.php...

CVE-2005-3157

SQL injection vulnerability in messages.php in PHP-Fusion 6.00.109 allows remote attackers to execute arbitrary SQL commands via the msgsend parameter, a different vulnerability than CVE-2005-3158 and CVE-2005-3159...

CVE-2005-3158

SQL injection vulnerability in messages.php in PHP-Fusion 6.00.106 and 6.00.107 allows remote attackers to execute arbitrary SQL commands via the 1 pmemailnotify and 2 pmsavesent parameters, a different vulnerability than CVE-2005-3157 and CVE-2005-3159...

CVE-2005-3159

CVE-2005-3159 is a SQL injection vulnerability in PHP-Fusion, specifically in messages.php where the msg_view parameter can be exploited to execute arbitrary SQL. It is described as a different vulnerability from CVE-2005-3157 and CVE-2005-3158, and is rated HIGH (CVSS v2 base score 7.5) with net...

CVE-2005-3160

PHP-Fusion

CVE-2005-3161

PHP-Fusion

CVE-2005-3159

SQL injection vulnerability in messages.php in PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the msgview parameter, a different vulnerability than CVE-2005-3157 and CVE-2005-3158...

CVE-2005-3160

Multiple SQL injection vulnerabilities in photogallery.php in PHP-Fusion allow remote attackers to execute arbitrary SQL commands via the 1 album and 2 photo parameters...

CVE-2005-3161

Multiple SQL injection vulnerabilities in PHP-Fusion before 6.00.110 allow remote attackers to execute arbitrary SQL commands via 1 the activate parameter in register.php and 2 the catid parameter in faq.php...

CVE-2005-3157

SQL injection vulnerability in messages.php in PHP-Fusion 6.00.109 allows remote attackers to execute arbitrary SQL commands via the msgsend parameter, a different vulnerability than CVE-2005-3158 and CVE-2005-3159...

CVE-2005-3157

CVE-2005-3157 describes an SQL injection in PHP-Fusion 6.00.109 caused by unsafely handling the msg_send parameter in messages.php. The vulnerability allows remote attackers to execute arbitrary SQL commands, with a likely impact on confidentiality, integrity, and availability as defined by the C...

CVE-2005-3158

PHP-Fusion

CVE-2005-3158

SQL injection vulnerability in messages.php in PHP-Fusion 6.00.106 and 6.00.107 allows remote attackers to execute arbitrary SQL commands via the 1 pmemailnotify and 2 pmsavesent parameters, a different vulnerability than CVE-2005-3157 and CVE-2005-3159...

CVE-2005-3157: Undefined Security Weakness

SQL injection vulnerability in messages.php in PHP-Fusion 6.00.109 allows remote attackers to execute arbitrary SQL commands via the msgsend parameter, a different vulnerability than CVE-2005-3158 and CVE-2005-3159...

CVE-2005-3161: Undefined Security Weakness

Multiple SQL injection vulnerabilities in PHP-Fusion before 6.00.110 allow remote attackers to execute arbitrary SQL commands via 1 the activate parameter in register.php and 2 the catid parameter in faq.php...