CVE-2006-6455

CVE-2006-6455 affects DUware DUdirectory 3.1 (and possibly DUdirectory Pro/Pro SQL 3.x). The vulnerability is multiple SQL injections in admin/default.asp that allow remote attackers to execute arbitrary SQL via the Username or Password parameters. This entry derives from third‑party information ...

CVE-2005-3976

CVE-2005-3976 describes a SQL injection in DUware products (DUamazon 3.1, DUarticle 1.1, DUclassified 4.2, DUdirectory 3.1/3.0, DUdownload 1.1, DUgallery 3.3, DUnews 1.1, DUpaypal 3.1/Pro 3.0) via the iType parameter in type.asp. The underlying issue is that user-supplied input is used to constru...

CVE-2006-6354

CVE-2006-6354 and related CVEs describe multiple SQL injection vulnerabilities in DuWare DUNews (and DUNews-family) detail.asp, allowing remote attackers to inject SQL via the (1) iNews, (2) iType, or (3) Action parameters. The iType parameter in type.asp is already covered by CVE-2005-3976. The ...