deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-4805
Published: 2008-10-31
Description: Multiple cross-site scripting (XSS) vulnerabilities in IBM Lotus Connections 2.x before 2.0.1 allow remote attackers to inject arbitrary web script or HTML via (1) the community title, (2) API input, and vectors related to the (3) Homepage, (4) Blogs, (5) Profiles, (6) Dogear, (7) Activities, and (8) Global Search components.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/32466; http://www-01.ibm.com/support/docview.wss?uid=swg27014008; http://www.securityfocus.com/bid/31989
CVE: CVE-2008-4806
Published: 2008-10-31
Description: Multiple SQL injection vulnerabilities in IBM Lotus Connections 2.x before 2.0.1 allow remote attackers to execute arbitrary SQL commands via the sortField parameter to unspecified components.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32466; http://www-01.ibm.com/support/docview.wss?uid=swg27014008; http://www.securityfocus.com/bid/31989
CVE: CVE-2008-4807
Published: 2008-10-31
Description: IBM Lotus Connections 2.x before 2.0.1 stores the password for the administrative user in the trace.log file, which allows local users to obtain sensitive information by reading this file.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 2.1 (LOW)
CWE: CWE-255
References: http://secunia.com/advisories/32466; http://www-01.ibm.com/support/docview.wss?uid=swg27014008; http://www.securityfocus.com/bid/31989
CVE: CVE-2008-4808
Published: 2008-10-31
Description: IBM Lotus Connections 2.x before 2.0.1 allows attackers to discover passwords via unspecified vectors.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://secunia.com/advisories/32466; http://www-01.ibm.com/support/docview.wss?uid=swg27014008; http://www.securityfocus.com/bid/31989
CVE: CVE-2008-4809
Published: 2008-10-31
Description: Multiple unspecified vulnerabilities in the Profiles search pages in IBM Lotus Connections 2.x before 2.0.1 have unknown impact and attack vectors related to "Active" content.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/32466; http://www-01.ibm.com/support/docview.wss?uid=swg27014008; http://www.securityfocus.com/bid/31989
CVE: CVE-2008-4810
Published: 2008-10-31
Description: The _expand_quoted_text function in libs/Smarty_Compiler.class.php in Smarty 2.6.20 before r2797 allows remote attackers to execute arbitrary PHP code via vectors related to templates and (1) a dollar-sign character, aka "php executed in templates;" and (2) a double quoted literal string, aka a "function injection security hole." NOTE: each vector affects slightly different SVN revisions.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://code.google.com/p/smarty-php/source/detail?r=2784&path=/trunk/libs/Smarty_Compiler.class.php; http://code.google.com/p/smarty-php/source/detail?r=2797&path=/trunk/libs/Smarty_Compiler.class.php; http://secunia.com/advisories/32329
CVE: CVE-2008-4811
Published: 2008-10-31
Description: The _expand_quoted_text function in libs/Smarty_Compiler.class.php in Smarty 2.6.20 r2797 and earlier allows remote attackers to execute arbitrary PHP code via vectors related to templates and a \ (backslash) before a dollar-sign character.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/32329; http://securityvulns.ru/Udocument746.html; http://www.debian.org/security/2008/dsa-1691
CVE: CVE-2008-4309
Published: 2008-10-31
Description: Integer overflow in the netsnmp_create_subtree_cache function in agent/snmp_agent.c in net-snmp 5.4 before 5.4.2.1, 5.3 before 5.3.2.3, and 5.2 before 5.2.5.1 allows remote attackers to cause a denial of service (crash) via a crafted SNMP GETBULK request, which triggers a heap-based buffer overflow,  related to the number of responses or repeats.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://lists.apple.com/archives/security-announce/2009/May/msg00002.html; http://lists.apple.com/archives/security-announce/2010//Dec/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html
CVE: CVE-2008-4863
Published: 2008-11-01
Description: Untrusted search path vulnerability in BPY_interface in Blender 2.46 allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to an erroneous setting of sys.path by the PySys_SetArgv function.
CVSS Score: 6.9 (MEDIUM)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=503632; http://security.gentoo.org/glsa/glsa-201001-07.xml; http://www.mandriva.com/security/advisories?name=MDVSA-2009:038
CVE: CVE-2008-4864
Published: 2008-11-01
Description: Multiple integer overflows in imageop.c in the imageop module in Python 1.5.2 through 2.5.1 allow context-dependent attackers to break out of the Python VM and execute arbitrary code via large integer values in certain arguments to the crop function, leading to a buffer overflow, a different vulnerability than CVE-2007-4965 and CVE-2008-1679.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: http://lists.apple.com/archives/security-announce/2009/Feb/msg00000.html; http://scary.beasts.org/security/CESA-2008-008.html; http://secunia.com/advisories/33937
CVE: CVE-2008-4865
Published: 2008-11-01
Description: Untrusted search path vulnerability in valgrind before 3.4.0 allows local users to execute arbitrary programs via a Trojan horse .valgrindrc file in the current working directory, as demonstrated using a malicious --db-command options.  NOTE: the severity of this issue has been disputed, but CVE is including this issue because execution of a program from an untrusted directory is a common scenario.
CVSS Score: 7.2 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2009-01/msg00004.html; http://secunia.com/advisories/33568; http://security.gentoo.org/glsa/glsa-200902-03.xml
CVE: CVE-2008-4866
Published: 2008-11-01
Description: Multiple buffer overflows in libavformat/utils.c in FFmpeg 0.4.9 before r14715, as used by MPlayer, allow context-dependent attackers to have an unknown impact via vectors related to execution of DTS generation code with a delay greater than MAX_REORDER_DELAY.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/fulldisclosure/2008-09/0103.html; http://lists.mplayerhq.hu/pipermail/ffmpeg-cvslog/2008-August/016011.html; http://lists.mplayerhq.hu/pipermail/ffmpeg-cvslog/2008-August/016012.html
CVE: CVE-2008-4867
Published: 2008-11-01
Description: Buffer overflow in libavcodec/dca.c in FFmpeg 0.4.9 before r14917, as used by MPlayer, allows context-dependent attackers to have an unknown impact via vectors related to an incorrect DCA_MAX_FRAME_SIZE value.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/fulldisclosure/2008-09/0103.html; http://lists.mplayerhq.hu/pipermail/ffmpeg-cvslog/2008-August/016352.html; http://secunia.com/advisories/34296
CVE: CVE-2008-4868
Published: 2008-11-01
Description: Unspecified vulnerability in the avcodec_close function in libavcodec/utils.c in FFmpeg 0.4.9 before r14787, as used by MPlayer, has unknown impact and attack vectors, related to a free "on random pointers."
CVSS Score: 10.0 (HIGH)
References: http://archives.neohapsis.com/archives/fulldisclosure/2008-09/0103.html; http://lists.mplayerhq.hu/pipermail/ffmpeg-cvslog/2008-August/016136.html; http://secunia.com/advisories/34385
CVE: CVE-2008-4869
Published: 2008-11-01
Description: FFmpeg 0.4.9, as used by MPlayer, allows context-dependent attackers to cause a denial of service (memory consumption) via unknown vectors, aka a "Tcp/udp memory leak."
CVSS Score: 10.0 (HIGH)
CWE: CWE-399
References: http://archives.neohapsis.com/archives/fulldisclosure/2008-09/0103.html; http://secunia.com/advisories/34385; http://security.gentoo.org/glsa/glsa-200903-33.xml
CVE: CVE-2008-4870
Published: 2008-11-01
Description: dovecot 1.0.7 in Red Hat Enterprise Linux (RHEL) 5, and possibly Fedora, uses world-readable permissions for dovecot.conf, which allows local users to obtain the ssl_key_password parameter value.
CVSS Score: 2.1 (LOW)
CWE: CWE-732
References: http://secunia.com/advisories/32164; http://secunia.com/advisories/33149; http://secunia.com/advisories/33624
CVE: CVE-2008-4871
Published: 2008-11-01
Description: Cross-site scripting (XSS) vulnerability in My Little Forum 1.75 and 2.0 Beta 23 allows remote attackers to inject arbitrary web script or HTML via BBcode IMG tags.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://securityreason.com/securityalert/4533; http://www.securityfocus.com/archive/1/487987/100/200/threaded; http://www.securityfocus.com/bid/27746
CVE: CVE-2008-4872
Published: 2008-11-01
Description: Cross-site scripting (XSS) vulnerability in bidhistory.php in iTechBids Gold 5.0 allows remote attackers to inject arbitrary web script or HTML via the item_id parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/28780; https://exchange.xforce.ibmcloud.com/vulnerabilities/46320; http://secunia.com/advisories/28780
CVE: CVE-2008-4873
Published: 2008-11-01
Description: board.cgi in Sepal SPBOARD 4.5 allows remote attackers to execute arbitrary commands via shell metacharacters in the file parameter during a down_file action.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/32459; http://securityreason.com/securityalert/4534; http://www.securityfocus.com/bid/31972
CVE: CVE-2008-4874
Published: 2008-11-01
Description: The web component in Philips Electronics VOIP841 DECT Phone with firmware 1.0.4.50 and 1.0.4.80 has a back door "service" account with "service" as its password, which makes it easier for remote attackers to obtain access.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-255
References: http://archives.neohapsis.com/archives/bugtraq/2008-02/0227.html; http://osvdb.org/42940; http://secunia.com/advisories/28978
CVE: CVE-2008-4875
Published: 2008-11-01
Description: Directory traversal vulnerability in the web server in Philips Electronics VOIP841 DECT Phone with firmware 1.0.4.50 and 1.0.4.80 allows remote authenticated users to read arbitrary files via a .. (dot dot) in a GET request.  NOTE: this can be leveraged with CVE-2008-4874 for unauthenticated access to sensitive files such as (1) save.dat and (2) apply.log, which can contain other credentials such as the Skype username and password.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/42941; http://secunia.com/advisories/28978; http://securityreason.com/securityalert/4536
CVE: CVE-2008-4876
Published: 2008-11-01
Description: Cross-site scripting (XSS) vulnerability in the web server component in Philips Electronics VOIP841 DECT Phone with firmware 1.0.4.50 and 1.0.4.80 allows remote attackers to inject arbitrary web script or HTML via the request URL, which is not properly handled in a 404 web error page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/28978; http://securityreason.com/securityalert/4536; http://www.securityfocus.com/archive/1/488127/100/200/threaded
CVE: CVE-2008-4877
Published: 2008-11-01
Description: SQL injection vulnerability in admin.php in WebCards 1.3, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the user parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/32440; http://securityreason.com/securityalert/4535; http://www.securityfocus.com/bid/31977
CVE: CVE-2008-4878
Published: 2008-11-01
Description: Unrestricted file upload vulnerability in the "Add Image Macro" feature in WebCards 1.3 allows remote authenticated administrators to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the uploaded file.
CVSS Score: 8.5 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/32440; http://securityreason.com/securityalert/4535; https://exchange.xforce.ibmcloud.com/vulnerabilities/46222
CVE: CVE-2008-3867
Published: 2008-11-03
Description: SQL injection vulnerability in spaces/emailuser.php in Interact 2.4.1 allows remote attackers to execute arbitrary SQL commands via the email_user_key parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/32359; http://secunia.com/secunia_research/2008-44/; http://securityreason.com/securityalert/4537
CVE: CVE-2008-3868
Published: 2008-11-03
Description: Cross-site request forgery (CSRF) vulnerability in Interact 2.4.1 allows remote attackers to hijack the authentication of super administrators for requests that create super administrator accounts.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/32434; http://secunia.com/secunia_research/2008-44/; http://securityreason.com/securityalert/4537
CVE: CVE-2008-4879
Published: 2008-11-04
Description: SQL injection vulnerability in prod.php in Maran PHP Shop allows remote attackers to execute arbitrary SQL commands via the cat parameter, a different vector than CVE-2008-4880.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/49532; http://securityreason.com/securityalert/4543; http://www.securityfocus.com/bid/32044
CVE: CVE-2008-4880
Published: 2008-11-04
Description: SQL injection vulnerability in prodshow.php in Maran PHP Shop allows remote attackers to execute arbitrary SQL commands via the id parameter, a different vector than CVE-2008-4879.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/49533; http://securityreason.com/securityalert/4548; http://www.securityfocus.com/bid/32043
CVE: CVE-2008-4881
Published: 2008-11-04
Description: SQL injection vulnerability in tr.php in YourFreeWorld Reminder Service Script allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/49593; http://secunia.com/advisories/32504; http://www.securityfocus.com/bid/32061
CVE: CVE-2008-4882
Published: 2008-11-04
Description: SQL injection vulnerability in tr.php in YourFreeWorld Autoresponder Hosting Script allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/49595; http://secunia.com/advisories/32504; http://securityreason.com/securityalert/4540
CVE: CVE-2008-4883
Published: 2008-11-04
Description: SQL injection vulnerability in tr.php in YourFreeWorld Blog Blaster Script allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/49594; http://secunia.com/advisories/32504; http://www.securityfocus.com/bid/32055
CVE: CVE-2008-4884
Published: 2008-11-04
Description: SQL injection vulnerability in tr.php in YourFreeWorld Classifieds Hosting Script allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/49596; http://securityreason.com/securityalert/4538; http://www.securityfocus.com/bid/32064
CVE: CVE-2008-4885
Published: 2008-11-04
Description: SQL injection vulnerability in tr1.php in YourFreeWorld Scrolling Text Ads Script allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/49597; http://securityreason.com/securityalert/4541; http://www.securityfocus.com/bid/32060
CVE: CVE-2008-4886
Published: 2008-11-04
Description: SQL injection vulnerability in index.php in YourFreeWorld Shopping Cart Script allows remote attackers to execute arbitrary SQL commands via the c parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/49501; http://osvdb.org/49598; http://secunia.com/advisories/32492
CVE: CVE-2008-4887
Published: 2008-11-04
Description: SQL injection vulnerability in index.php in NetRisk 2.0 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter in a (1) profile page (profile.php) or (2) game page (game.php).  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/49498; http://secunia.com/advisories/32484; http://securityreason.com/securityalert/4544
CVE: CVE-2008-4888
Published: 2008-11-04
Description: Cross-site scripting (XSS) vulnerability in error.php in NetRisk 2.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the error parameter to index.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/49497; http://secunia.com/advisories/32484; http://www.securityfocus.com/bid/32051
CVE: CVE-2008-4889
Published: 2008-11-04
Description: SQL injection vulnerability in index.php in deV!L'z Clanportal (DZCP) 1.4.9.6 and earlier allows remote attackers to execute arbitrary SQL commands via the users parameter in an addbuddy operation in a buddys action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/49500; http://secunia.com/advisories/32458; http://securityreason.com/securityalert/4552
CVE: CVE-2008-4890
Published: 2008-11-04
Description: SQL injection vulnerability in products.php in 1st News 4 Professional (PR 1) allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/49534; http://securityreason.com/securityalert/4553; http://www.securityfocus.com/bid/32042
CVE: CVE-2008-4908
Published: 2008-11-04
Description: maps/Info/combine.pl in CrossFire crossfire-maps 1.11.0 allows local users to overwrite arbitrary files via a symlink attack on a temporary file.
CVSS Score: 3.3 (LOW)
CWE: CWE-59
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=496358; http://secunia.com/advisories/32487; http://www.securityfocus.com/bid/30893
CVE: CVE-2008-4909
Published: 2008-11-04
Description: Cross-site request forgery (CSRF) vulnerability in CompactCMS 1.1 and earlier allows remote attackers to perform unauthorized actions as legitimate users via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://holisticinfosec.org/content/view/90/45/; http://secunia.com/advisories/32464; https://exchange.xforce.ibmcloud.com/vulnerabilities/46198
CVE: CVE-2008-4910
Published: 2008-11-04
Description: The BasicService in Sun Java Web Start allows remote attackers to execute arbitrary programs on a client machine via a file:// URL argument to the showDocument method.
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://securityreason.com/securityalert/4542; http://www.securityfocus.com/archive/1/497799/100/0/threaded; http://www.securityfocus.com/archive/1/497972/100/0/threaded
CVE: CVE-2008-4911
Published: 2008-11-04
Description: PHP remote file inclusion vulnerability in read.php in Chattaitaliano Istant-Replay allows remote attackers to execute arbitrary PHP code via a URL in the data parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://archives.neohapsis.com/archives/bugtraq/2008-04/0196.html; http://www.securityfocus.com/bid/28797; https://exchange.xforce.ibmcloud.com/vulnerabilities/41844
CVE: CVE-2008-4912
Published: 2008-11-04
Description: SQL injection vulnerability in popup_img.php in the fotogalerie module in RS MAXSOFT allows remote attackers to execute arbitrary SQL commands via the fotoID parameter.  NOTE: this issue was disclosed by an unreliable researcher, so it might be incorrect.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4547; http://www.securityfocus.com/bid/28735; https://exchange.xforce.ibmcloud.com/vulnerabilities/41798
CVE: CVE-2008-4913
Published: 2008-11-04
Description: Directory traversal vulnerability in admin.php in LokiCMS 0.3.3 and earlier allows remote attackers to delete arbitrary files via a .. (dot dot) in the delete parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://lokicms.com/; http://securityreason.com/securityalert/4554; http://www.securityfocus.com/bid/28985
CVE: CVE-2008-4891
Published: 2008-11-04
Description: Cross-site scripting (XSS) vulnerability in signme.inc.php in Planetluc SignMe 1.5 before 1.55 allows remote attackers to inject arbitrary web script or HTML via the hash parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://holisticinfosec.org/content/view/88/45/; http://secunia.com/advisories/32506; http://www.planetluc.com/en/news/20081101_xss.php?navurl=/en/news.php
CVE: CVE-2008-4892
Published: 2008-11-04
Description: Cross-site scripting (XSS) vulnerability in gallery.inc.php in Planetluc MyGallery 1.7.2 and earlier, and possibly other versions before 1.8.1, allows remote attackers to inject arbitrary web script or HTML via the mghash parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://holisticinfosec.org/content/view/86/45/; http://secunia.com/advisories/32505; http://www.planetluc.com/en/news/20081101_xss.php?navurl=/en/news.php
CVE: CVE-2008-4893
Published: 2008-11-04
Description: Cross-site scripting (XSS) vulnerability in templates/mytribiqsite/tribal-GPL-1066/includes/header.inc.php in Tribiq CMS 5.0.10a, when register_globals is enabled, allows remote attackers to inject arbitrary web script or HTML via the template_path parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://secunia.com/advisories/32548; http://www.securityfocus.com/bid/32050; https://exchange.xforce.ibmcloud.com/vulnerabilities/46265
CVE: CVE-2008-4894
Published: 2008-11-04
Description: Directory traversal vulnerability in templates/mytribiqsite/tribal-GPL-1066/includes/header.inc.php in Tribiq CMS 5.0.10a, when register_globals is enabled and magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the template_path parameter.  NOTE: it was later reported that this issue also affects 5.0.12c.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/32548; http://www.securityfocus.com/bid/32018; https://exchange.xforce.ibmcloud.com/vulnerabilities/46264
CVE: CVE-2008-4895
Published: 2008-11-04
Description: SQL injection vulnerability in tr.php in YourFreeWorld Downline Builder allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/49599; http://www.securityfocus.com/bid/32046; http://www.securityfocus.com/bid/32047
CVE: CVE-2008-4896
Published: 2008-11-04
Description: Cross-site scripting (XSS) vulnerability in fichiers/add_url.php in Logz CMS 1.3.1 allows remote attackers to inject arbitrary web script or HTML via the art parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/32542; http://www.securityfocus.com/bid/32022; https://exchange.xforce.ibmcloud.com/vulnerabilities/46258
CVE: CVE-2008-4897
Published: 2008-11-04
Description: SQL injection vulnerability in fichiers/add_url.php in Logz podcast CMS 1.3.1, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the art parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://packetstormsecurity.org/0810-exploits/logzpodcast-sql.txt; http://secunia.com/advisories/32542; http://securityreason.com/securityalert/4546