CVE-2007-3549

CVE-2007-3549 describes an SQL injection in Buddy Zone 1.5: the vulnerable script is view_sub_cat.php and the flaw is exploitable via the cat_id parameter, allowing remote execution of arbitrary SQL commands. Affected software: Buddy Zone 1.5; vulnerable component: view_sub_cat.php (cat_id). Impa...

CVE-2007-3526

CVE-2007-3526 affects Buddy Zone 1.5 and earlier, with multiple SQL injection vulnerabilities that allow remote attackers to execute arbitrary SQL commands via specific parameters: news_id in view_news.php, cat_id in view_events.php, and member_id in video_gallery.php. The root cause is not expli...

CVE-2006-3494

CVE-2006-3494 affects Buddy Zone 1.0.1 and is described in multiple sources as cross-site scripting (XSS) vulnerabilities. The affected functionality involves user-supplied parameters that can be manipulated to inject arbitrary HTML/script: (1) cat_id in view_classifieds.php; (2) id in view_ad.ph...