CVE-2009-4745

Dreamlevels DreamPoll 3.1 is affected by multiple SQL injection vulnerabilities in index.php. The issue allows an attacker to inject via the login action using one of three parameters: sortField, sortDesc, or pageNumber, enabling arbitrary SQL execution. The CVE entry is tracked with a base metri...

CVE-2009-4746

The CVE describes a Cross-site Scripting (XSS) vulnerability in Dreamlevels DreamPoll 3.1. Specifically, index.php is vulnerable via the recordsPerPage parameter in a poll_default login action, allowing remote attackers to inject arbitrary web script/HTML. Affected software: Dreamlevels DreamPoll...