CVE-2004-2200

DUforum (DUware) versions 3.0–3.1 are affected by a cross-site scripting (XSS) vulnerability in the message text handling, allowing remote attackers to inject arbitrary web script or HTML. The root cause is improper handling/validation of message text content, leading to script execution in the v...

CVE-2005-2048

Summary (CVE-2005-2048): DUforum 3.1 (DUware) is affected by multiple SQL injection vulnerabilities due to improper input sanitization. The exploitable parameters are (1) iMsg in messages.asp, (2) iFor in post.asp, (3) iFor in forums.asp, and (4) id in userEdit.asp. This allows remote attackers t...

CVE-2004-2201

CVE-2004-2201 describes an SQL injection vulnerability in DUware DUforum 3.0–3.1. The issue allows remote attackers to execute arbitrary SQL commands by providing crafted input via the FOR_ID parameter in messages.asp, the MSG_ID parameter in messageDetail.asp, or the password parameter on the lo...