deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2007-1956
Published: 2007-04-11
Description: SQL injection vulnerability in ubbthreads.php in Groupee UBB.threads 6.1.1 and earlier allows remote attackers to execute arbitrary SQL commands via the C parameter.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/2545; http://www.securityfocus.com/archive/1/465076/100/0/threaded; http://www.securityfocus.com/bid/23369
CVE: CVE-2007-1957
Published: 2007-04-11
Description: Multiple PHP remote file inclusion vulnerabilities in Guernion Sylvain Portail Web Php (aka Gsylvain35 Portail Web, PwP) allow remote attackers to execute arbitrary PHP code via a URL in the pageAll parameter to index.php in (1) template/Vert/, or (2) template/Noir/.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/35290; http://securityreason.com/securityalert/2543; http://www.securityfocus.com/archive/1/465083/100/0/threaded
CVE: CVE-2007-1958
Published: 2007-04-11
Description: Buffer overflow in TinyMUX before 2.4 allows attackers to cause a denial of service via unspecified vectors related to "too many substring matches in a regexp $-command." NOTE: some of these details are obtained from third party information.
CVSS Score: 5.0 (MEDIUM)
References: http://www.tinymux.org/changes.txt; http://www.vupen.com/english/advisories/2007/1213; http://www.tinymux.org/changes.txt
CVE: CVE-2007-1959
Published: 2007-04-11
Description: Unspecified vulnerability in the process_cmdent function in command.cpp in TinyMUX before 2.4 has unknown impact and attack vectors, related to lack of the "'other half' of buffer overflow protection."
CVSS Score: 10.0 (HIGH)
References: http://www.tinymux.org/changes.txt; http://www.vupen.com/english/advisories/2007/1213; http://www.tinymux.org/changes.txt
CVE: CVE-2007-1960
Published: 2007-04-11
Description: SQL injection vulnerability in visit.php in the Rha7 Downloads (rha7downloads) 1.0 module for XOOPS, and possibly other versions up to 1.10, allows remote attackers to execute arbitrary SQL commands via the lid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/34460; http://secunia.com/advisories/24790; http://www.securityfocus.com/bid/23320
CVE: CVE-2007-1961
Published: 2007-04-11
Description: PHP remote file inclusion vulnerability in mutant_functions.php in the Mutant 0.9.2 portal for phpBB 2.2 allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/37396; http://www.securityfocus.com/bid/23319; http://www.vupen.com/english/advisories/2007/1265
CVE: CVE-2007-1962
Published: 2007-04-11
Description: SQL injection vulnerability in index.php in the WF-Snippets 1.02 and earlier module for XOOPS allows remote attackers to execute arbitrary SQL commands via the c parameter in a cat action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/34459; http://secunia.com/advisories/24781; http://www.vupen.com/english/advisories/2007/1263
CVE: CVE-2007-1963
Published: 2007-04-11
Description: SQL injection vulnerability in the create_session function in class_session.php in MyBB (aka MyBulletinBoard) 1.2.3 and earlier allows remote attackers to execute arbitrary SQL commands via the Client-IP HTTP header, as utilized by index.php, a related issue to CVE-2006-3775.
CVSS Score: 7.5 (HIGH)
References: http://community.mybboard.net/attachment.php?aid=5842; http://community.mybboard.net/showthread.php?tid=18002; http://osvdb.org/34657
CVE: CVE-2007-1964
Published: 2007-04-11
Description: member.php in MyBB (aka MyBulletinBoard), when debug mode is available, allows remote authenticated users to change the password of any account by providing the account's registered e-mail address in a debug request for a do_lostpw action, which prints the change password verification code in the debug output.
CVSS Score: 6.0 (MEDIUM)
References: http://securityreason.com/securityalert/2544; http://www.securityfocus.com/archive/1/464267/100/100/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/33345
CVE: CVE-2007-1965
Published: 2007-04-11
Description: Multiple cross-site scripting (XSS) vulnerabilities in eXV2 CMS 2.0.4.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the set_lang parameter to (1) archive.php, (2) article.php, (3) index.php, or (4) topics.php.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7962&w=2; http://www.majorsecurity.de/index_2.php?major_rls=major_rls38; http://www.securityfocus.com/bid/23314
CVE: CVE-2007-1966
Published: 2007-04-11
Description: Session fixation vulnerability in eXV2 CMS 2.0.4.3 and earlier allows remote attackers to hijack web sessions by setting the PHPSESSID cookie.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-287, CWE-287
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7962&w=2; http://www.majorsecurity.de/index_2.php?major_rls=major_rls38; http://marc.info/?l=bugtraq&m=[PII_REDACTED]7962&w=2
CVE: CVE-2007-1967
Published: 2007-04-11
Description: PHP remote file inclusion vulnerability in index.php in stat12 allows remote attackers to execute arbitrary PHP code via a URL in the langpath parameter.  NOTE: this issue was published by an unreliable researcher, and there is little information to determine which product is actually affected.  This is probably an invalid report based on analysis by CVE and a third party
CVSS Score: 6.8 (MEDIUM)
References: http://securityreason.com/securityalert/2555; http://www.attrition.org/pipermail/vim/2007-April/001488.html; http://www.attrition.org/pipermail/vim/2007-April/001508.html
CVE: CVE-2007-1968
Published: 2007-04-11
Description: PHP remote file inclusion vulnerability in games.php in Sam Crew MyBlog, possibly 1.0 through 1.6, allows remote attackers to execute arbitrary PHP code via a URL in the scoreid parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://securityreason.com/securityalert/2548; http://www.attrition.org/pipermail/vim/2007-April/001503.html; http://www.securityfocus.com/archive/1/464716/100/0/threaded
CVE: CVE-2007-1969
Published: 2007-04-11
Description: Cross-site scripting (XSS) vulnerability in admin/modify.php in Sam Crew MyBlog remote attackers to inject arbitrary web script or HTML via the id parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://securityreason.com/securityalert/2549; http://www.securityfocus.com/archive/1/464712/100/0/threaded; http://securityreason.com/securityalert/2549
CVE: CVE-2007-1970
Published: 2007-04-11
Description: Mozilla Firefox does not warn the user about HTTP elements on an HTTPS page when the HTTP elements are dynamically created by a delayed document.write, which allows remote attackers to supply unauthenticated content and conduct phishing attacks.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/34536; http://www.securityfocus.com/archive/1/464719/100/0/threaded; http://osvdb.org/34536
CVE: CVE-2007-1971
Published: 2007-04-11
Description: SQL injection vulnerability in fotokategori.asp in Gazi Okul Sitesi 2007 allows remote attackers to execute arbitrary SQL commands via the query string.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/35266; http://securityreason.com/securityalert/2547; http://www.securityfocus.com/archive/1/464738/100/0/threaded
CVE: CVE-2007-1279
Published: 2007-04-11
Description: Unspecified vulnerability in the installer for Adobe Bridge 1.0.3 update for Apple OS X, when patching with desktop management tools, allows local users to gain privileges via unspecified vectors during installation of the update by a different user who has administrative privileges.
CVSS Score: 7.2 (HIGH)
References: http://secunia.com/advisories/24854; http://www.adobe.com/support/security/bulletins/apsb07-09.html; http://www.osvdb.org/34896
CVE: CVE-2007-1363
Published: 2007-04-11
Description: Multiple SQL injection vulnerabilities in DropAFew before 0.2.1 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in the delete action in (a) search.php or (b) search-pda.php, or the (2) calories parameter in a save action in editlogcal.php.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/24861; http://www.cynops.de/advisories/CVE-2007-1363.txt; http://www.dropafew.com/sphpblog/comments.php?y=07&m=04&entry=entry[PII_REDACTED]37
CVE: CVE-2007-1364
Published: 2007-04-11
Description: DropAFew before 0.2.1 does not require authorization for certain privileged actions, which allows remote attackers to (1) view the logged calorie information of arbitrary users via the id parameter in editlogcal.php, (2) add arbitrary links via links.php, or (3) create arbitrary users via newaccount2.php.
CVSS Score: 6.4 (MEDIUM)
References: http://secunia.com/advisories/24861; http://www.dropafew.com/sphpblog/comments.php?y=07&m=04&entry=entry[PII_REDACTED]37; http://www.securityfocus.com/bid/23400
CVE: CVE-2007-1559
Published: 2007-04-11
Description: Multiple stack-based buffer overflows in SonicDVDDashVRNav.dll in Roxio CinePlayer 3.2 allow remote attackers to execute arbitrary code via (1) unspecified long property values to SonicMediaPlayer.dll or (2) long arguments to unspecified methods in SonicMediaPlayer.dll.
CVSS Score: 9.3 (HIGH)
References: http://osvdb.org/34779; http://secunia.com/advisories/22251; http://secunia.com/secunia_research/2007-46/advisory/
CVE: CVE-2007-1874
Published: 2007-04-11
Description: Adobe ColdFusion MX 7 for Linux and Solaris uses insecure permissions for certain scripts and directories, which allows local users to execute arbitrary code or obtain sensitive information via the (1) CFMX7DreamWeaverExtensions.mxp, (2) CFReportBuilderInstaller.exe, (3) .com.zerog.registry.xml, (4) uninstall.lax, (5) license.txt, (6) Readme.htm, (7) .com.zerog.registry.xml, (8) k2adminstop, or (9) k2adminstart files; or (10) certain files in lib/wsconfig/.
CVSS Score: 7.2 (HIGH)
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=510; http://osvdb.org/34930; http://secunia.com/advisories/24850
CVE: CVE-2007-1973
Published: 2007-04-11
Description: Race condition in the Virtual DOS Machine (VDM) in the Windows Kernel in Microsoft Windows NT 4.0 allows local users to modify memory and gain privileges via the temporary \Device\PhysicalMemory section handle, a related issue to CVE-2007-1206.
CVSS Score: 6.9 (MEDIUM)
References: http://osvdb.org/37635; http://research.eeye.com/html/advisories/published/AD20070410a.html; http://securityreason.com/securityalert/2563
CVE: CVE-2007-1974
Published: 2007-04-12
Description: SQL injection vulnerability in the getArticle function in class/wfsarticle.php in WF-Section (aka WF-Sections) 1.0.1, as used in Xoops modules such as (1) Zmagazine 1.0, (2) Happy Linux XFsection 1.07 and earlier, and possibly other modules, allows remote attackers to execute arbitrary SQL commands via the articleid parameter to print.php.
CVSS Score: 7.5 (HIGH)
References: http://addons.zarilia.com/index.php?page_type=static&id=43; http://osvdb.org/41387; http://osvdb.org/52230
CVE: CVE-2007-1975
Published: 2007-04-12
Description: Multiple PHP remote file inclusion vulnerabilities in SLAED CMS 2 allow remote attackers to execute arbitrary PHP code via a URL in the (1) path parameter to admin/admin.php or the (2) modpath parameter to index.php.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/35220; http://osvdb.org/35221; http://securityreason.com/securityalert/2567
CVE: CVE-2007-1976
Published: 2007-04-12
Description: PHP remote file inclusion vulnerability in index.php in the Virii Info 1.10 and earlier module for Xoops allows remote attackers to execute arbitrary PHP code via a URL in the xoopsConfig[root_path] parameter. NOTE: the issue has been disputed by a reliable third party, stating that the application's checkSuperglobals function defends against the attack
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/37429; http://www.attrition.org/pipermail/vim/2007-April/001489.html; http://www.attrition.org/pipermail/vim/2007-April/001490.html
CVE: CVE-2007-1977
Published: 2007-04-12
Description: Cross-site scripting (XSS) vulnerability in index_cms.php in holaCMS 1.4.10 allows remote attackers to inject arbitrary web script or HTML via the acuparam parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/34685; http://secunia.com/advisories/24656; http://www.majorsecurity.de/index_2.php?major_rls=major_rls37
CVE: CVE-2007-1978
Published: 2007-04-12
Description: SQL injection vulnerability in index.php in the Arcade 1.00 module for PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the cid parameter in a view_game_list action.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/37410; http://www.vupen.com/english/advisories/2007/1205; https://exchange.xforce.ibmcloud.com/vulnerabilities/33361
CVE: CVE-2007-1979
Published: 2007-04-12
Description: SQL injection vulnerability in index.php in the PopnupBlog 2.52 and earlier module for Xoops allows remote attackers to execute arbitrary SQL commands via the postid parameter, possibly involving the get_blogid_from_postid function in class/PopnupBlogUtils.php.  NOTE: later versions such as 3.03 and 3.05 might also be affected.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/24761; http://www.securityfocus.com/bid/23286; http://www.vupen.com/english/advisories/2007/1206
CVE: CVE-2007-1980
Published: 2007-04-12
Description: SQL injection vulnerability in index.php in the Topliste 1.0 module for PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the cid parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/37411; http://www.securityfocus.com/bid/23256; http://www.vupen.com/english/advisories/2007/1204
CVE: CVE-2007-1981
Published: 2007-04-12
Description: The safevoid_vsnprintf function in Metamod-P 1.19p29 and earlier on Windows allows remote attackers to cause a denial of service (daemon crash) via a long meta list command.
CVSS Score: 7.8 (HIGH)
References: http://secunia.com/advisories/24738; http://sourceforge.net/forum/forum.php?forum_id=681753; http://sourceforge.net/project/shownotes.php?release_id=498782
CVE: CVE-2007-1982
Published: 2007-04-12
Description: Multiple PHP remote file inclusion vulnerabilities in Really Simple PHP and Ajax (RSPA) 2007-03-23 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the (1) __IncludeFilePHPClass, (2) __ClassPath, and (3) __class parameters to (a) rspa/framework/Controller_v5.php, and (b) rspa/framework/Controller_v4.php.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/24671; http://www.bugtraq.ir/articles/advisory/RSPA_File_Inclusion/6; http://www.securityfocus.com/bid/23246
CVE: CVE-2007-1983
Published: 2007-04-12
Description: PHP remote file inclusion vulnerability in include/default_header.php in Cyboards PHP Lite 1.21 allows remote attackers to execute arbitrary PHP code via a URL in the script_path parameter, a different vector than CVE-2006-2871.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/35300; http://www.attrition.org/pipermail/vim/2007-April/001509.html; http://www.securityfocus.com/bid/23306
CVE: CVE-2007-1984
Published: 2007-04-12
Description: PHP remote file inclusion vulnerability in index.php in lite-cms 0.2.1 allows remote attackers to execute arbitrary PHP code via a URL in the inc parameter.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/2559; http://www.securityfocus.com/archive/1/464672/100/0/threaded; http://securityreason.com/securityalert/2559
CVE: CVE-2007-1985
Published: 2007-04-12
Description: Multiple PHP remote file inclusion vulnerabilities in phpexplorator.php in phpexplorator 2.0 allow remote attackers to execute arbitrary PHP code via a URL in the (1) cmd or (2) lang_path parameter.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/2564; http://www.securityfocus.com/archive/1/464695/100/0/threaded; http://securityreason.com/securityalert/2564
CVE: CVE-2007-1986
Published: 2007-04-12
Description: Multiple PHP remote file inclusion vulnerabilities in barnraiser AROUNDMe 0.7.7 allow remote attackers to execute arbitrary PHP code via a URL in the (1) language_path_core parameter to inc/core_profile.header.php, the (2) template_path_core parameter to template/barnraiser_01/maint_contact_view.tpl.php, and the (3) template_path parameter to template/barnraiser_01/default.tpl.php. NOTE: this issue might overlap CVE-2006-5533.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/34623; http://osvdb.org/34624; http://osvdb.org/34625
CVE: CVE-2007-1987
Published: 2007-04-12
Description: Multiple PHP remote file inclusion vulnerabilities in PHPEcho CMS 2.0 allow remote attackers to execute arbitrary PHP code via a URL in the (1) _plugin_file parameter to smarty/internals/core.load_pulgins.php or the (2) root_path parameter to index.php.  NOTE: CVE disputes (1) because the inclusion occurs within a function that is not called during a direct request. CVE disputes (2) because root_path is defined in config.php before use
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/34117; http://securityreason.com/securityalert/2551; http://www.securityfocus.com/archive/1/464709/100/0/threaded
CVE: CVE-2007-1988
Published: 2007-04-12
Description: Cross-site scripting (XSS) vulnerability in kernel/filters.inc.php in PHPEcho CMS 2.0 allows remote attackers to inject arbitrary web script or HTML via the id parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/35262; http://securityreason.com/securityalert/2550; http://www.securityfocus.com/archive/1/464707/100/0/threaded
CVE: CVE-2007-1989
Published: 2007-04-12
Description: Multiple cross-site scripting (XSS) vulnerabilities in DotClear before 1.2.6 allow remote attackers to inject arbitrary web script or HTML via the (1) post_id parameter to ecrire/trackback.php or the (2) tool_url parameter to tools/thememng/index.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2007-April/053720.html; http://secunia.com/advisories/24829; http://www.dotclear.net/forum/viewtopic.php?id=26573
CVE: CVE-2007-1990
Published: 2007-04-12
Description: PHP remote file inclusion vulnerability in games.php in Sam Crew MyBlog, possibly 1.0 through 1.6, allows remote attackers to execute arbitrary PHP code via a URL in the id parameter, a different vector than CVE-2007-1968.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/37432; http://www.vupen.com/english/advisories/2007/1302; http://osvdb.org/37432
CVE: CVE-2007-1991
Published: 2007-04-12
Description: Cross-site scripting (XSS) vulnerability in mail/signup.asp in CmailServer WebMail 5.4.3, and possibly earlier, allows remote attackers to inject arbitrary web script or HTML via the Comment parameter, a different vector than CVE-2007-1927.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/24812; http://www.securityfocus.com/bid/23363; https://exchange.xforce.ibmcloud.com/vulnerabilities/33501
CVE: CVE-2007-1992
Published: 2007-04-12
Description: Multiple PHP remote file inclusion vulnerabilities in the com_zoom 2.5 beta 2 and earlier module for Mambo allow remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter to (1) EXIF_Makernote.php or (2) EXIF.php in classes/iptc/.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/23415; http://www.vupen.com/english/advisories/2007/1353; https://exchange.xforce.ibmcloud.com/vulnerabilities/33580
CVE: CVE-2007-1993
Published: 2007-04-12
Description: Buffer overflow in the pfs_mountd.rpc RPC daemon in the Portable File System (PFS) in HP-UX B.11.00, B.11.11, and B.11.23 allows remote attackers to execute arbitrary code by sending "a call to procedure 5, followed by a crafted payload to procedure 2."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00913684; http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=512; http://secunia.com/advisories/24855
CVE: CVE-2007-1994
Published: 2007-04-12
Description: Unspecified vulnerability in the Address and Routing Parameter Area (ARPA) transport functionality in HP-UX B.11.00 allows local users to cause a denial of service via unknown vectors.  NOTE: due to lack of vendor details, it is not clear whether this is the same as CVE-2007-0916.
CVSS Score: 4.9 (MEDIUM)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00944467; http://www.securityfocus.com/bid/23410; http://www.securitytracker.com/id?1017892
CVE: CVE-2007-1995
Published: 2007-04-12
Description: bgpd/bgp_attr.c in Quagga 0.98.6 and earlier, and 0.99.6 and earlier 0.99 versions, does not validate length values in the MP_REACH_NLRI and MP_UNREACH_NLRI attributes, which allows remote attackers to cause a denial of service (daemon crash or exit) via crafted UPDATE messages that trigger an assertion error or out of bounds read.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-20
References: http://bugzilla.quagga.net/show_bug.cgi?id=354; http://bugzilla.quagga.net/show_bug.cgi?id=355; http://secunia.com/advisories/24808
CVE: CVE-2007-1996
Published: 2007-04-12
Description: PHP remote file inclusion vulnerability in codebreak.php in CodeBreak, probably 1.1.2 and earlier, allows remote attackers to execute arbitrary PHP code via a URL in the process_method parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/24846; http://securityreason.com/securityalert/2562; http://www.securityfocus.com/archive/1/465382/100/0/threaded
CVE: CVE-2006-7193
Published: 2007-04-12
Description: PHP remote file inclusion vulnerability in unit_test/test_cases.php in Smarty 2.6.1 allows remote attackers to execute arbitrary PHP code via a URL in the SMARTY_DIR parameter.  NOTE: this issue is disputed by CVE and a third party because SMARTY_DIR is a constant
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3491&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2920&w=2; http://osvdb.org/31096
CVE: CVE-2007-1998
Published: 2007-04-12
Description: Direct static code injection vulnerability in HIOX Guest Book (HGB) 4.0 allows remote attackers to inject arbitrary PHP code via the Email field, which results in code execution through a direct request to gb.php.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/24835; http://www.vupen.com/english/advisories/2007/1333; https://exchange.xforce.ibmcloud.com/vulnerabilities/33540
CVE: CVE-2007-1999
Published: 2007-04-12
Description: PHP remote file inclusion vulnerability in index.php in Weatimages 1.7.1 and earlier, when weatimages.ini is missing, allows remote attackers to execute arbitrary PHP code via a URL in the ini[langpack] parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/34807; http://secunia.com/advisories/24863; http://www.vupen.com/english/advisories/2007/1335
CVE: CVE-2007-2000
Published: 2007-04-12
Description: Multiple SQL injection vulnerabilities in admin/admin.php in Crea-Book 1.0 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) pseudo or (2) passe parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/24862; http://www.osvdb.org/34816; http://www.vupen.com/english/advisories/2007/1344
CVE: CVE-2007-2001
Published: 2007-04-12
Description: Multiple direct static code injection vulnerabilities in admin/configurer2.php in Crea-Book 1.0 and earlier allow remote authenticated administrators to execute arbitrary PHP code via the "Fond de la page" (background color) field and other unspecified fields, which injects into config.inc.php3.
CVSS Score: 6.5 (MEDIUM)
References: http://secunia.com/advisories/24862; http://www.osvdb.org/34817; https://www.exploit-db.com/exploits/3701