CVE-2006-6177

CVE-2006-6177 describes an SQL injection in Neocrome Seditio

CVE-2006-6577

CVE-2006-6577 affects Neocrome Land Down Under (LDU) 8.x and earlier, where polls.php is vulnerable to SQL injection via the id parameter. The remote attacker can cause arbitrary SQL execution, with partial impact on confidentiality, integrity, and availability (CVSS 2.0 base score 6.8). Connecte...

CVE-2007-4057

The CVE-2007-4057 entry describes an unrestricted file upload vulnerability in Neocrome Seditio (pfs.php) affecting 121 and earlier. Remote authenticated users can upload arbitrary PHP code by supplying a filename ending in (1) .php.gif, (2) .php.jpg, or (3) .php.png, enabling code execution on t...

CVE-2006-6343

CVE-2006-6343 concerns a SQL injection in the polls.php id parameter of Land Down Under / Seditio (Neocrome Seditio) 1.10 and earlier. The Nessus NASL details show the remote input to polls.php is not sanitized before use in a database query when magic_quotes_gpc is disabled, enabling an unauthen...

CVE-2007-6202

CVE-2007-6202 exposes a SQL injection in Neocrome Seditio CMS (plugins/search/search.php, via plug.php) on version 121 and earlier. The vulnerability arises from unsanitized input to the pag_sub parameter used in database queries when magic_quotes_gpc is disabled, allowing remote attackers to man...

CVE-2006-2634

The vulnerability CVE-2006-2634 is an XSS flaw in Neocrome Land Down Under (LDU) within Neocrome Seditio 102, exploitable via an HTTP Referer header to inject arbitrary script/HTML. The impact stated is that remote attackers can execute script in a victim’s browser. The connected documents confir...

CVE-2009-1411

CVE-2009-1411 describes an SQL injection in the Events plugin for Seditio CMS 1.0. The vulnerability exists in events/inc/events.inc.php and allows remote attackers to inject arbitrary SQL via the c parameter to plug.php. This leads to potential confidentiality and integrity impacts on the affect...

CVE-2006-6344

Neocrome Seditio 1.10 and earlier are affected by SQL injection vulnerabilities across multiple pages/components, including plugins/ipsearch/ipsearch.admin.php, pfs/pfs.edit.inc.php, and users/users.register.inc.php. The CVE-2006-6344 entry notes these as unspecified vulnerabilities with possible...

CVE-2012-5914

Neocrome Seditio builds 160 and 161 contain multiple XSS vulnerabilities in the sed_import function (system/functions.php), exploitable via the newmsg or rtext parameters. Remote attackers could inject arbitrary web script or HTML. No explicit remediation information is provided in the connected ...

CVE-2012-5916

CVE-2012-5916 concerns Neocrome Seditio build 161, where a remote attacker can disclose sensitive information by directly requesting one of three SQL files: docs/new/seditio-createnew-160.sql, docs/upgrade/sedito_convert_to_utf8.optional.sql, or system/install/install.parser.sql. The accompanying...

CVE-2012-5915

CVE-2012-5915 affects Neocrome Seditio builds 161 and earlier. The vulnerability is an information-disclosure flaw where remote attackers can cause an error message to reveal the installation path by directly requesting any of the following: view.php, plugins/contact/lang/contact.en.lang.php, sys...