CVE-2009-2113

FretsWeb 1.2 is affected by multiple SQL injection vulnerabilities exploitable via the name parameter to player.php and the hash parameter to song.php. The underlying issue is unsafe handling of these inputs that allows arbitrary SQL execution. Potential impact is remote arbitrary SQL commands; e...

CVE-2009-2109

CVE-2009-2109 affects FretsWeb 1.2. Multiple directory traversal vulnerabilities allow remote attackers to read arbitrary files via the language parameter to charts.php and the fretsweb_language cookie parameter to unspecified vectors, possibly related to admin/common.php. Root cause: improper ha...