CVE-2010-2354

SQL injection vulnerability in subscribe.php in Pilot Group PG eLMS Pro allows remote attackers to execute arbitrary SQL commands via the courseid parameter...

Sql injection

SQL injection vulnerability in subscribe.php in Pilot Group PG eLMS Pro allows remote attackers to execute arbitrary SQL commands via the courseid parameter...

CVE-2010-2354

CVE-2010-2354 affects Pilot Group (PG) eLMS Pro, where subscribe.php is vulnerable to SQL injection via the course_id parameter. The root cause is improper handling of input leading to arbitrary SQL execution by remote attackers, with impact described as allowing arbitrary commands and partial da...

CVE-2010-2356

CVE-2010-2356 affects Pilot Group (PG) eLMS Pro: XSS in subscribe.php, exploitable via the course_id parameter. Root cause is reflected/script injection in the course_id handling. The NVD notes a CVSSv2 base score of 4.3 (Medium) with network attack vector, no authentication, and partial integrit...

CVE-2010-2356

Cross-site scripting XSS vulnerability in subscribe.php in Pilot Group PG eLMS Pro allows remote attackers to inject arbitrary web script or HTML via the courseid parameter...

CVE-2010-2356: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in subscribe.php in Pilot Group PG eLMS Pro allows remote attackers to inject arbitrary web script or HTML via the courseid parameter...

CVE-2010-2354: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in subscribe.php in Pilot Group PG eLMS Pro allows remote attackers to execute arbitrary SQL commands via the courseid parameter...

CVE-2008-3709: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in CyBoards PHP Lite 1.21 allow remote attackers to inject arbitrary web script or HTML via the 1 lOptionsOptions, 2 lNavAdminOptions, or 3 lNavReturn parameter to options.php; or the 4 lNavReturn parameter to subscribe.php...

CVE-2004-2725: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Aztek Forum 4.0 allow remote attackers to inject arbitrary web script or HTML via 1 the search parameter in a search.php, 2 the email parameter in b subscribe.php, and 3 the return and 4 title parameters in c forum2.php...

CVE-2007-3627

Multiple SQL injection vulnerabilities in PHP Lite Calendar Express 2.2 allow remote attackers to execute arbitrary SQL commands via the cid parameter to 1 login.php, 2 auth.php, and 3 subscribe.php. NOTE: the month.php, year.php, week.php, and day.php vectors are already covered by CVE-2005-4009...

CVE-2007-3627: Undefined Security Weakness

Multiple SQL injection vulnerabilities in PHP Lite Calendar Express 2.2 allow remote attackers to execute arbitrary SQL commands via the cid parameter to 1 login.php, 2 auth.php, and 3 subscribe.php. NOTE: the month.php, year.php, week.php, and day.php vectors are already covered by CVE-2005-4009...

CVE-2006-6786: Undefined Security Weakness

Open Newsletter 2.5 and earlier allows remote authenticated administrators to execute arbitrary PHP code by inserting the code into the email parameter to 1 subscribe.php or 2 unsubscribe.php...

Sql injection

Multiple SQL injection vulnerabilities in MWNewsletter 1.0.0b allow remote attackers to execute arbitrary SQL commands via the 1 useremail parameter to a unsubscribe.php or b subscribe.php; or the 2 username parameter to subscribe.php. NOTE: the provenance of this information is unknown; the...

CVE-2006-1692

CVE-2006-1692 concerns MWNewsletter 1.0.0b, where multiple SQL injection flaws are exposed via input parameters. Specifically, unsanitized user_email (in unsubscribe.php and subscribe.php) and user_name (in subscribe.php) allow remote attackers to inject arbitrary SQL commands, enabling potential...

CVE-2006-1690: Undefined Security Weakness

Cross-site scripting XSS vulnerability in subscribe.php in MWNewsletter 1.0.0b allows remote attackers to inject arbitrary web script or HTML via the username parameter...

CVE-2006-1692: Undefined Security Weakness

Multiple SQL injection vulnerabilities in MWNewsletter 1.0.0b allow remote attackers to execute arbitrary SQL commands via the 1 useremail parameter to a unsubscribe.php or b subscribe.php; or the 2 username parameter to subscribe.php. NOTE: the provenance of this information is unknown; the...