Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Anantasoft Gazelle CMS 1.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 user parameter to user.php or 2 lookup parameter to search.php...

CVE-2009-3171

Multiple cross-site scripting XSS vulnerabilities in Anantasoft Gazelle CMS 1.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 user parameter to user.php or 2 lookup parameter to search.php...

Sql injection

Multiple SQL injection vulnerabilities in OneCMS 2.4, and possibly earlier, allow remote attackers to execute arbitrary SQL commands via the 1 username parameter $usernameb variable to alogin.php or 2 user parameter to staff.php...

CVE-2008-7208: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in OneCMS 2.4, and possibly earlier, allow remote attackers to execute arbitrary SQL commands via the 1 username parameter $usernameb variable to alogin.php or 2 user parameter to staff.php...

CVE-2009-3180: Undefined Security Weakness

Anantasoft Gazelle CMS 1.0 allows remote attackers to conduct a password reset for other users via a modified user parameter to renew.php...

CVE-2008-6917: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in admin.php in Exocrew ExoPHPDesk 1.2 Final allows remote attackers to execute arbitrary SQL commands via the username user parameter...

CVE-2009-2573: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in MiniTwitter 0.2 beta, when magicquotesgpc is disabled, allow remote authenticated users to execute arbitrary SQL commands via the 1 user parameter to a index.php and b rss.php...

CVE-2009-1816

SQL injection vulnerability in admin.php in My Game Script 2.0 allows remote attackers to execute arbitrary SQL commands via the user parameter aka the username field. NOTE: some of these details are obtained from third party information...

CVE-2009-1816: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in admin.php in My Game Script 2.0 allows remote attackers to execute arbitrary SQL commands via the user parameter aka the username field. NOTE: some of these details are obtained from third party information...

LimeSurvey sUser Parameter SQL Injection

The remote host is running LimeSurvey, an open source tool for online surveys. The version of LimeSurvey installed on the remote host fails to sanitize user-supplied input passed to the 'sUser' argument in the 'checkUser' method of the 'LsrcHelper' class in 'admin/remotecontrol/lsrc.helper.php'...

CVE-2008-6631

Multiple cross-site scripting XSS vulnerabilities in index.php in BlogPHP 2.0 allow remote attackers to inject arbitrary web script or HTML via the 1 user parameter in a sendmessage action and the 2 username parameter when registering a new user, different vectors than CVE-2008-0679...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in index.php in BlogPHP 2.0 allow remote attackers to inject arbitrary web script or HTML via the 1 user parameter in a sendmessage action and the 2 username parameter when registering a new user, different vectors than CVE-2008-0679...

CVE-2008-6631: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in index.php in BlogPHP 2.0 allow remote attackers to inject arbitrary web script or HTML via the 1 user parameter in a sendmessage action and the 2 username parameter when registering a new user, different vectors than CVE-2008-0679...

Sql injection

Multiple SQL injection vulnerabilities in nForum 1.5 allow remote attackers to execute arbitrary SQL commands via the 1 id parameter to showtheme.php and the 2 user parameter to userinfo.php...

CVE-2009-0852

showme.php in CelerBB 0.0.2 allows remote attackers to obtain "reserved information" via the user parameter...

Code injection

showme.php in CelerBB 0.0.2 allows remote attackers to obtain "reserved information" via the user parameter...

CVE-2009-0852

showme.php in CelerBB 0.0.2 allows remote attackers to obtain "reserved information" via the user parameter...

CVE-2009-0852

CVE-2009-0852 concerns CelerBB 0.0.2. Multiple connected sources confirm that the vulnerability exists in the showme.php module via the user parameter, enabling remote attackers to retrieve sensitive or “reserved” information. The CVE description and corroborating entries (including exploit refer...

CVE-2009-0852: Exposure of Sensitive Information to an Unauthorized Actor

showme.php in CelerBB 0.0.2 allows remote attackers to obtain "reserved information" via the user parameter...

CVE-2009-0810: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in login.php in xGuestbook 2.0 allows remote attackers to execute arbitrary SQL commands via the user parameter...