CVE-2009-2328

CVE-2009-2328 affects KerviNet Forum versions 1.1 and earlier. The issue is in admin/edit_user.php which does not require administrative authentication, enabling remote attackers to delete arbitrary user accounts and perform SQL injection via the del_user_id parameter. The available connected doc...

CVE-2009-2326

CVE-2009-2326 describes multiple SQL injection vulnerabilities in KerviNet Forum 1.1 and earlier. The weaknesses allow remote attackers to execute arbitrary SQL commands via two confirmed vectors: (1) an enter_parol cookie to index.php in an auto action, and (2) the topic parameter to message.php...

CVE-2007-6727

The CVE-2007-6727 entry describes a SQL injection in KerviNet Forum 1.1, specifically topic.php, where the parameter forum can be exploited to execute arbitrary SQL commands remotely. This is the underlying vulnerability: improper sanitization/parameter handling in the forum parameter leading to ...

CVE-2009-2327

CVE-2009-2327 affects KerviNet Forum 1.1 and earlier. The vulnerability is a Cross-site Scripting (XSS) flaw in add_voting.php, exploitable via the v_variant1 parameter. The issue allows remote authenticated users to inject arbitrary web script or HTML. Documents consistently describe the same ve...

CVE-2009-2329

CVE-2009-2329 affects KerviNet Forum 1.1 and earlier. The vulnerability enables remote attackers to disclose sensitive information by directly requesting any of 16 include_files/ PHP files (admin/head.php, voting_diagram.php, voting.php, topics_search.php, topics_list.php, top_part.php, quick_sea...