EUVD-2005-2576

Malware in sbrugna...

CVE-2006-3994: Undefined Security Weakness

SQL injection vulnerability in the u2usendrecp function in u2u.inc.php in XMB aka extreme message board 1.9.6 Alpha and earlier allows remote attackers to execute arbitrary SQL commands via the u2uid parameter to u2u.php, which is directly accessed from $POST and bypasses the protection scheme...

Sql injection

Multiple SQL injection vulnerabilities in XMB Forums 1.9.3 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 $u2uselect array parameter to u2u.inc.php and 2 $val variable fidpw0 cookie value in today.php...

CVE-2005-2575

CVE-2005-2575: XMB Forum 1.9.1 contains a SQL injection in u2u.inc.php that allows remote attackers to inject arbitrary SQL via values inserted into the $in variable. This is a web application vulnerability affecting XMB Forum’s PHP code as described in the CVE entry and related records. The prov...

CVE-2005-2575: Undefined Security Weakness

SQL injection vulnerability in u2u.inc.php in XMB Forum 1.9.1 allows remote attackers to execute arbitrary SQL commands via certain values that are inserted into the $in variable...

Sql injection and global variables poisoning in XMB Forum 1.9.1

Vendor notified at and partial patch: http://forums.xmbforum.com/viewthread.php?tid=754523 firstly the input validation at xmb.php: foreach $global as $num = $array if isarray$array extract$array, EXTROVERWRITE; this should put to not overwrite any variables cause it overwrite server set variable...