CVE-2006-0668

CVE-2006-0668 describes an SQL injection in the PHP application PwsPHP 1.2.3, specifically via the id parameter in index.php (and possibly in message.php within the espace_membre module). The underlying issue is a lack of input validation/safe query construction, enabling remote attackers to exec...

CVE-2005-1509

The CVE-2005-1509 entry describes an SQL injection in profil.php of PwsPHP 1.2.2, exploitable via the id parameter. This relates to a vulnerability in the profiling page that allows remote attackers to execute arbitrary SQL commands. The NVD entry assigns a CVSS v2 base score of 7.5 (HIGH, networ...

CVE-2005-1508

PWSPHP (Portail Web System) is affected by cross-site scripting (XSS) in version 1.2.2 due to insufficient input validation in multiple modules/parameters (e.g., news, stats, profil.php, memberlist, recherche) and specifically the SettingsBase.php skin parameter per the NASL entry. The vulnerabil...

CVE-2005-1512

CVE-2005-1512 concerns the Admin panel of PwsPHP 1.2.2 , where the upload validation for image files is inadequate. The vulnerability allows remote attackers to upload potentially arbitrary files, which could lead to arbitrary code execution on the server. The CVSS details from the entry indicate...

CVE-2006-0942

CVE-2006-0942 is an SQL injection in profil.php of PwsPHP 1.2.3 (and possibly earlier) that allows remote attackers to execute arbitrary SQL commands through the aff_news_form parameter, a vulnerability distinct from CVE-2005-1509. Connected records confirm the affected software (PwsPHP), vulnera...

CVE-2005-1511

PwsPHP 1.2.2 is affected by an authentication bypass vulnerability caused by manipulation of the Pseudo cookie, allowing remote attackers to post arbitrary comments. The issue is that authentication can be bypassed and comments posted without proper authorization. No explicit remediation details ...

CVE-2006-0943

The CVE-2006-0943 issue affects PwsPHP 1.2.3, specifically the sondages module’s index.php. The underlying vulnerability is a SQL injection via the id parameter to index.php, enabling remote attackers to execute arbitrary SQL commands. The available connected records corroborate the same descript...

CVE-2005-1510

The CVE-2005-1510 entry affects PwsPHP 1.2.2. A remote attacker can obtain partial confidential information by making a direct request to the admin directory, triggering an error message that reveals the path. The issue is described as an information-disclosure bug in the admin directory handling...