CVE-2008-3291

CVE-2008-3291 describes an SQL injection in the AproxEngine (aka Aprox CMS Engine) 5.1.0.4. The vulnerability exists in index.php where the id parameter is used unsafely, enabling remote attackers to execute arbitrary SQL commands. The NVD entry lists a base score of 7.5 (HIGH) with network acces...

CVE-2008-2895

CVE-2008-2895 describes a directory traversal vulnerability in the AproxEngine 5.1.0.4 web interface (index.php). The issue allows an attacker to induce local file inclusion and execution by supplying a .. in the page parameter, due to the underlying path traversal in the PHP code. This vulnerabi...