CVE-2006-1849

The CVE-2006-1849 entry describes multiple SQL injection vulnerabilities in the web component members_only/index.cgi of xFlow (versions 5.46.11 and earlier). The underlying issue is improper handling of user-supplied input, allowing an attacker to manipulate SQL queries through the (1) position a...

CVE-2006-1850

CVE-2006-1850 affects xFlow 5.46.11 and earlier, with multiple XSS vulnerabilities allowing remote attackers to inject arbitrary script/HTML through parameters in members_only/index.cgi (level, position, id, action) and page in customer_area/index.cgi. The connected sources (NVD, CVE records, PRI...

CVE-2006-1851

CVE-2006-1851 affects xFlow 5.46.11 and earlier. The flaw allows remote attackers to determine the installation path via the action parameter in members_only/index.cgi and the page parameter in customer_area/index.cgi, likely due to invalid values. Exploitation details are not provided beyond thi...