CVE-2006-1133

Multiple cross-site scripting XSS vulnerabilities in vbzoom 1.11 allow remote attackers to inject arbitrary web script or HTML via the UserID parameter to 1 comment.php or 2 contact.php. NOTE: the profile.php/UserName vector is already covered by CVE-2005-2441...

CVE-2006-1133: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in vbzoom 1.11 allow remote attackers to inject arbitrary web script or HTML via the UserID parameter to 1 comment.php or 2 contact.php. NOTE: the profile.php/UserName vector is already covered by CVE-2005-2441...

CVE-2006-1008: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in N8cms 1.1 and 1.2 allow remote attackers to inject arbitrary web script or HTML via the 1 dir and 2 pageid parameter to a index.php and 3 userid parameter to b mailto.php. NOTE: it is possible that issues 1 and 2 are resultant from SQL injectio...

phpRPC Library rpc_decoder.php decode() Function Arbitrary Code Execution

The remote host has installed on it the phpRPC library, an xmlrpc library written in PHP and bundled with applications such as RunCMS and exoops. The version of phpRPC on the remote host fails to sanitize user input to the 'server.php' script before using it in an 'eval' function, which may allow...

CVE-2006-0927: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in the JGS-XA JGS-Gallery Addon 4.0.0 and earlier for Woltlab Burning Board wBB 2.x allow remote attackers to inject arbitrary web script or HTML via the 1 userid parameter in a jgsgalerieslideshow.php and b jgsgaleriescroll.php, and the 2 katid...

CVE-2006-0823: Undefined Security Weakness

Multiple SQL injection vulnerabilities in Geeklog 1.4.0 before 1.4.0sr1 and 1.3.11 before 1.3.11sr4 allow remote attackers to inject arbitrary SQL commands via the 1 userid variable to users.php or 2 sessid variable to lib-sessions.php...

CVE-2005-2464

login.php in PCXP/TOPPE CMS allows remote attackers to bypass authentication and gain privileges by modifying the cookie to match the target userid...

CVE-2005-4286: Undefined Security Weakness

Unspecified vulnerability in PhpLogCon before 1.2.2 allows remote attackers to use arbitrary profiles via unknown vectors involving "'smart' values for userid and password," probably involving an SQL injection vulnerability in the 1 pass and 2 usr parameters in submit.php...

CVE-2005-4139

Multiple SQL injection vulnerabilities in ThWboard before 3 Beta 2.84 allow remote attackers to execute arbitrary SQL commands via the 1 year parameter in calendar.php, 2 user parameter array in vprofile.php, and 3 the userid parameter in misc.php...

CVE-2005-3918: Undefined Security Weakness

Multiple SQL injection vulnerabilities in OvBB 0.08a allow remote attackers to execute arbitrary SQL commands via the 1 threadid parameter to thread.php and 2 userid parameter to profile.php. NOTE: the vendor disputes these issues, saying "these reports are completely unsubstantial...

OvBB SQL vulnerabilities.

OvBB SQL vulnerabilities. Vuln. dicovered by : r0t Date: 24 nov. 2005 Orginal advisory:http://pridels.blogspot.com/2005/11/ovbb-sql-vulnerabilities.html Vendor:http://www.ovbb.org/ affected version: V0.08a and prior Vuln. description: Input passed to the "threadid" parameter in "thread.php" isn't...

CVE-2005-3386

SQL injection vulnerability in Techno Dreams Web Directory script allows remote attackers to execute arbitrary SQL commands and bypass authentication via the userid parameter in admin/login.asp...

CVE-2005-3383

SQL injection vulnerability in Techno Dreams Announcement script allows remote attackers to execute arbitrary SQL commands and bypass authentication via the userid parameter in admin/login.asp...

CVE-2005-3383

SQL injection vulnerability in Techno Dreams Announcement script allows remote attackers to execute arbitrary SQL commands and bypass authentication via the userid parameter in admin/login.asp...

CVE-2005-3385

The CVE-2005-3385 entry describes a SQL injection vulnerability in Techno Dreams Mailing List script that allows remote attackers to execute arbitrary SQL and bypass authentication via the userid parameter in admin/login.asp. Affected component: the Mailing List script; vulnerability type: SQL in...

CVE-2005-3384: Undefined Security Weakness

SQL injection vulnerability in Techno Dreams Guest Book script allows remote attackers to execute arbitrary SQL commands and bypass authentication via the userid parameter in admin/login.asp...

CVE-2005-3383: Undefined Security Weakness

SQL injection vulnerability in Techno Dreams Announcement script allows remote attackers to execute arbitrary SQL commands and bypass authentication via the userid parameter in admin/login.asp...

CVE-2005-3386: Undefined Security Weakness

SQL injection vulnerability in Techno Dreams Web Directory script allows remote attackers to execute arbitrary SQL commands and bypass authentication via the userid parameter in admin/login.asp...

CVE-2005-3385: Undefined Security Weakness

SQL injection vulnerability in Techno Dreams Mailing List script allows remote attackers to execute arbitrary SQL commands and bypass authentication via the userid parameter in admin/login.asp...

CVE-2005-3207: Undefined Security Weakness

The forms servlet f90servlet in Oracle Forms 4.5.10.22 allows remote attackers to cause a denial of service TNS listener stop via a userid parameter that contains a STOP command...