CVE-2009-4838

CVE-2009-4838 : A SQL injection vulnerability exists in Base_Ag_Common.php of the Basic Analysis and Security Engine (BASE) before version 1.4.3.1. Remote attackers can execute arbitrary SQL commands via unspecified parameters due to inadequate input handling. This risk affects BASE deployments r...

CVE-2009-4837

CVE-2009-4837 involves multiple cross-site scripting (XSS) vulnerabilities in the Basic Analysis and Security Engine (BASE) prior to version 1.4.3.1. The affected components allow remote attackers to inject arbitrary web script or HTML via the following parameters: (1) sig[1] in base/base_qry_mai...

CVE-2009-4839

The CVE-2009-4839 entry concerns the Basic Analysis and Security Engine (BASE), likely versions 1.4.4 and earlier. The issue comprises multiple input-validation vulnerabilities in BASE allowing remote attackers to inject arbitrary web script or HTML (XSS) via parameters to admin/base_roleadmin.ph...

CVE-2005-3325

CVE-2005-3325 concerns SQL injection in ACID/BASE consoles (acidlab/acidbase) due to missing input sanitising and improper parameter validation. Debian and related advisories (DSA-893-1) confirm remote exploitation via base_qry_main.php/acid_qry_main.php and related console components, with fixed...

CVE-2007-6156

BASE/Base Analysis and Security Engine (BASE) before 1.3.9 contains cross-site scripting in base_qry_main.php, exploitable via sig[0] and sig[1] parameters. This affects BASE 1.3.8 and earlier releases per CVE-2007-6156. Impact: remote attackers can inject arbitrary web script/HTML. Mitigation: u...

CVE-2007-5578

BASE is affected: the Basic Analysis and Security Engine (BASE) before version 1.3.8 fails to exit after issuing a redirect, enabling remote attackers to bypass authentication via multiple scripts (notably base_main.php and base_qry_alert.php). Exploitation details are not provided in the connect...

CVE-2012-1198

CVE-2012-1198 affects BASE 1.4.5. The issue occurs in base_ag_main.php where an attacker can upload a file with an executable extension via a create action and then access it via a view action, enabling remote code execution. The NVD entry assigns a CVSSv2 base score of 7.5 (HIGH) with network ac...

CVE-2005-4878

CVE-2005-4878 details: Multiple XSS vulnerabilities in ACID 0.9.6b20 (acid_qry_main.php) and BASE 1.2 (base_qry_main.php), plus unspecified consoles, allow remote injection via the sig[1] parameter and related inputs. Connected documents also flag a separate but related issue CVE-2007-6156 affect...

CVE-2012-1199

BASE 1.4.5 contains multiple PHP remote file inclusion vulnerabilities that allow an attacker to execute arbitrary PHP code by passing a URL to the BASE_path parameter (and related parameters) to various BASE scripts (e.g., base_ag_main.php, base_db_setup.php, base_graph_.php, base_qry_ .php, bas...