CVE-2015-7381: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in install.php in Web Reference Database aka refbase through 0.9.6 allow remote attackers to execute arbitrary PHP code via the 1 pathToMYSQL or 2 databaseStructureFile parameter, a different issue than CVE-2015-6008...

PT-2015-7114

Name of the Vulnerable Software and Affected Versions Web Reference Database aka refbase versions prior to 0.9.6 and bleeding-edge versions prior to 2015-01-08 Description The issue allows remote attackers to conduct XML injection attacks. This can be achieved via two parameters: the id parameter...

CVE-2015-6009: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Web Reference Database aka refbase through 0.9.6 allow remote attackers to execute arbitrary SQL commands via 1 the where parameter to rss.php or 2 the sqlQuery parameter to search.php, a different issue than CVE-2015-7382...

CVE-2015-7383: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Web Reference Database aka refbase through 0.9.6 and bleeding-edge through 2015-04-28 allow remote attackers to inject arbitrary web script or HTML via the 1 adminUserName, 2 pathToMYSQL, 3 databaseStructureFile, or 4 pathToBibutils parameter t...