CVE-2008-0504

Multiple SQL injection vulnerabilities in Coppermine Photo Gallery CPG before 1.4.15 allow remote authenticated administrators to execute arbitrary SQL commands via the 1 albumid, 2 startpic, and 3 numpics parameters to util.php; and 4 cidarray parameter to reviewcom.php...

CVE-2008-0504

Multiple SQL injection vulnerabilities in Coppermine Photo Gallery CPG before 1.4.15 allow remote authenticated administrators to execute arbitrary SQL commands via the 1 albumid, 2 startpic, and 3 numpics parameters to util.php; and 4 cidarray parameter to reviewcom.php...

CVE-2008-0290

Affected software: Digital Hive 2.0 RC2 and earlier. The CVE describes two SQL injection vectors: (1) via the selectskin parameter to an unspecified program, allowing remote execution of arbitrary SQL commands; (2) via the user_id parameter in gestione_membre.php to base.php, allowing remote auth...

CVE-2008-0267

Multiple SQL injection vulnerabilities in eTicket 1.5.5.2 allow remote authenticated users to execute arbitrary SQL commands via the 1 status, 2 sort, and 3 way parameters to search.php; and allow remote authenticated administrators to execute arbitrary SQL commands via the 4 msg and 5 password...

CVE-2007-6548

Multiple direct static code injection vulnerabilities in RunCMS before 1.6.1 allow remote authenticated administrators to inject arbitrary PHP code via the 1 header and 2 footer parameters to modules/system/admin.php in a meta-generator action, 3 the disclaimer parameter to modules/system/admin.p...

Code injection

Multiple direct static code injection vulnerabilities in RunCMS before 1.6.1 allow remote authenticated administrators to inject arbitrary PHP code via the 1 header and 2 footer parameters to modules/system/admin.php in a meta-generator action, 3 the disclaimer parameter to modules/system/admin.p...

CVE-2007-6548

Multiple direct static code injection vulnerabilities in RunCMS before 1.6.1 allow remote authenticated administrators to inject arbitrary PHP code via the 1 header and 2 footer parameters to modules/system/admin.php in a meta-generator action, 3 the disclaimer parameter to modules/system/admin.p...

Sql injection

Multiple SQL injection vulnerabilities in phpMyRealty PMR 1.0.9 allow 1 remote attackers to execute arbitrary SQL commands via the type parameter to search.php and 2 remote authenticated administrators to execute arbitrary SQL commands via the listingupdateddays parameter to admin/findlistings.ph...

Code injection

Direct static code injection vulnerability in dirsys/modules/config/post.php in JBC Explorer 7.20 RC1 and earlier allows remote authenticated administrators to inject arbitrary PHP code via the DEBUG parameter, which can be executed by accessing config.inc.php. NOTE: this can be exploited by...

Code injection

Direct static code injection vulnerability in the download module in Flatnuke 3 allows remote authenticated administrators to inject arbitrary PHP code into a description.it.php file in a subdirectory of Download/ by saving a description and setting fneditmode to 1. NOTE: unauthenticated remote...

Code injection

Unspecified vulnerability in the Settings component in the administration system in Jeebles Directory 2.9.60 allows remote authenticated administrators to execute arbitrary PHP code via unspecified vectors related to settings.inc.php. NOTE: the provenance of this information is unknown; the detai...

CVE-2007-5453

Multiple eval injection vulnerabilities in Php-Stats 0.1.9.2 allow remote authenticated administrators to execute arbitrary code by writing PHP sequences to the php-stats-options record in the options table, which is used in an eval function call by 1 admin.php, 2 click.php, 3 download.php, and...

Directory traversal

Directory traversal vulnerability in viewlog.php in Coppermine Photo Gallery CPG 1.4.12 and earlier allows remote authenticated administrators to include and execute arbitrary local files via a .. dot dot in the log parameter...

CVE-2007-4976

Directory traversal vulnerability in viewlog.php in Coppermine Photo Gallery CPG 1.4.12 and earlier allows remote authenticated administrators to include and execute arbitrary local files via a .. dot dot in the log parameter...

CVE-2007-4976

Directory traversal vulnerability in viewlog.php in Coppermine Photo Gallery CPG 1.4.12 and earlier allows remote authenticated administrators to include and execute arbitrary local files via a .. dot dot in the log parameter...

CVE-2007-4717

Multiple cross-site scripting XSS vulnerabilities in Claroline before 1.8.6 allow remote authenticated administrators to inject arbitrary web script or HTML via the 1 dir parameter in admin/adminusers.php, the 2 action parameter in admin/advancedUserSearch.php, and the 3 view parameter in...

Cross site scripting

The management interface in ZyNOS firmware 3.62WK.6 on the Zyxel Zywall 2 device allows remote authenticated administrators to cause a denial of service infinite reboot loop via invalid configuration data. NOTE: this issue might not cross privilege boundaries, and it might be resultant from CSRF;...

Cross site scripting

Cross-site scripting XSS vulnerability in Forms/General1 in the management interface in ZyNOS firmware 3.62WK.6 on the Zyxel Zywall 2 device allows remote authenticated administrators to inject arbitrary web script or HTML via the sysSystemName parameter...

CVE-2007-4318

Cross-site scripting XSS vulnerability in Forms/General1 in the management interface in ZyNOS firmware 3.62WK.6 on the Zyxel Zywall 2 device allows remote authenticated administrators to inject arbitrary web script or HTML via the sysSystemName parameter...

CVE-2007-4319

The management interface in ZyNOS firmware 3.62WK.6 on the Zyxel Zywall 2 device allows remote authenticated administrators to cause a denial of service infinite reboot loop via invalid configuration data. NOTE: this issue might not cross privilege boundaries, and it might be resultant from CSRF;...