EUVD-2006-0352

Malware in sbrugna...

Cross site scripting

Cross-site scripting XSS vulnerability in SaralBlog 1.0 allows remote attackers to inject arbitrary web script or HTML via a website field in a new comment to view.php, which is not properly handled in the comment function in functions.php...

Sql injection

Multiple SQL injection vulnerabilities in SaralBlog 1.0 allow remote attackers to execute arbitrary SQL commands via the search parameter to search.php. NOTE: the id/viewprofile.php issue is already covered by CVE-2005-4058...

CVE-2006-0346

CVE-2006-0346 is an XSS vulnerability in SaralBlog 1.0. The issue arises when an attacker-supplied value is not properly handled in the website field of a new comment to view.php, due to insufficient sanitization in functions.php. The NVD entry lists a base score of 4.3 (Medium) with low confiden...