CVE-2008-1632

CVE-2008-1632 affects CuteFlow 2.10.0 with multiple SQL injection flaws in pages/editmailinglist_step1.php (listid), pages/edituser.php (userid), pages/editfield.php (fieldid), and pages/edittemplate_step1.php (templateid). Root cause is unsafe SQL construction allowing remote authenticated users...

CVE-2008-1630

CVE-2008-1630 concerns CuteFlow 1.5.0 and 2.10.0, where multiple stored/reflected cross-site scripting (XSS) flaws exist in the web UI. The root cause is insufficient input validation/sanitization of the language parameter across pages such as page/showcirculation.php, edittemplate_step2.php, sho...

CVE-2008-1631

CVE-2008-1631 corresponds to a SQL injection vulnerability in CuteFlow versions 1.5.0 and 2.10.0. The flaw occurs in login.php, related to the UserId parameter used by the login form (indexed in index.php), allowing remote attackers to craft arbitrary SQL commands. Multiple sources (NVD entry, CV...