CVE-2006-6519

CVE-2006-6519 describes an SQL injection in the ProNews 1.5 component, specifically in the file lire-avis.php . The vulnerability is triggered via the aa parameter, allowing remote attackers to execute arbitrary SQL commands. The available documents attribute the issue to improper handling of use...

CVE-2006-6518

CVE-2006-6518 affects ProNews 1.5 and involves multiple reflected cross-site scripting (XSS) flaws. The vulnerability is triggered by unsanitized user-controllable input in several parameters: (1) pseudo, (2) email, (3) date, (4) sujet, (5) message, (6) site, and (7) lien to admin/change.php, and...

CVE-2006-6580

The connected sources confirm a vulnerability in ProNews 1.5 where admin/change.php does not verify that a user is authorized to modify news items. This permits remote attackers to add or delete information within an item and potentially cause other impacts. Root cause: missing access control che...