CVE-2005-4366

CVE-2005-4366 describes multiple SQL injection vulnerabilities in DRZES HMS 3.2. The issues allow remote attackers to execute arbitrary SQL commands via various parameters across several PHP scripts (e.g., plan_id to domains.php, viewusage.php, pop_accounts.php, databases.php, ftp_users.php, cron...

CVE-2005-4137

CVE-2005-4137 describes an SQL injection in DRZES HMS 3.2: viewinvoice.php allows remote attackers to manipulate the backend via the invoiceID parameter, enabling arbitrary SQL execution. This is part of broader SQL injection findings in DRZES HMS 3.2 (noting that the 4137 vector is explicitly th...

CVE-2005-4136

CVE-2005-4136 describes a Cross-site Scripting (XSS) vulnerability in DRZES HMS 3.2, specifically in login.php where the customerEmailAddress parameter can be exploited to inject arbitrary web script/HTML. The issue affects the login process and can be triggered remotely, with a NVD base score of...

CVE-2005-4367

The CVE-2005-4367 entry describes an XSS in DRZES HMS 3.2 (and later CONTROLzx, renamed from DRZES, 3.3.4) via register_domain.php, likely through unspecified search parameters (potentially the Domain Availability field). Affected function is register_domain.php; root cause is improper handling/e...