CVE-2008-2521

The CVE describes a SQL injection in the YABSoft Mega File Hosting Script (MFH/MFHS) version 1.2, specifically in members.php, where the fid parameter can be manipulated by remote authenticated users to execute arbitrary SQL commands. The entry is supported by multiple sources (NVD, CVE lists, an...

CVE-2009-0966

Affected product/variant: YABSoft Mega File Hosting 1.2 (cross.php). Vulnerability: PHP remote file inclusion via the url parameter in cross.php, enabling execution of arbitrary PHP code. NOTE: can also include and execute arbitrary local files using .. sequences. Impact (as documented): arbitrar...

CVE-2009-3647

CVE-2009-3647 describes a cross-site scripting (XSS) vulnerability in the YABSoft Mega File Hosting Script (MFH/MFHS) 1.2, where an attacker can inject arbitrary web script or HTML via the moudi parameter in emaullinks.php. The evidence in connected sources confirms the affected component and the...