deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-2870
Published: 2008-06-26
Description: Multiple SQL injection vulnerabilities in ShareCMS 0.1 Beta allow remote attackers to execute arbitrary SQL commands via the (1) eventID parameter to event_info.php and the (2) userID parameter to list_user.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/29916; http://www.vupen.com/english/advisories/2008/1925/references; https://exchange.xforce.ibmcloud.com/vulnerabilities/43318
CVE: CVE-2008-2871
Published: 2008-06-26
Description: Multiple cross-site scripting (XSS) vulnerabilities in template2.php in PEGames allow remote attackers to inject arbitrary web script or HTML via the (1) sitetitle, (2) sitenav, (3) sitemain, and (4) sitealt parameters.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/29865; https://exchange.xforce.ibmcloud.com/vulnerabilities/43314; http://www.securityfocus.com/bid/29865
CVE: CVE-2008-2872
Published: 2008-06-26
Description: SQL injection vulnerability in default.asp in sHibby sHop 2.2 and earlier allows remote attackers to execute arbitrary SQL commands via the sayfa parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30787; http://www.securityfocus.com/bid/29875; https://exchange.xforce.ibmcloud.com/vulnerabilities/43295
CVE: CVE-2008-2873
Published: 2008-06-26
Description: sHibby sHop 2.2 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request to Db/urun.mdb.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/30787; https://exchange.xforce.ibmcloud.com/vulnerabilities/43296; https://www.exploit-db.com/exploits/5895
CVE: CVE-2008-2874
Published: 2008-06-26
Description: SQL injection vulnerability in index.php in Softbiz Jokes & Funny Pics Script allows remote attackers to execute arbitrary SQL commands via the sbjoke_id parameter, a different vector than CVE-2008-1050.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30810; http://www.securityfocus.com/bid/29931; http://www.vupen.com/english/advisories/2008/1951/references
CVE: CVE-2008-2875
Published: 2008-06-26
Description: SQL injection vulnerability in index.php in Webdevindo-CMS 1.0.0 allows remote attackers to execute arbitrary SQL commands via the hal parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/29930; http://www.vupen.com/english/advisories/2008/1949/references; https://exchange.xforce.ibmcloud.com/vulnerabilities/43361
CVE: CVE-2008-2876
Published: 2008-06-26
Description: Directory traversal vulnerability in index.php in mUnky 0.0.1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the zone parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://www.securityfocus.com/archive/1/495503; http://www.securityfocus.com/archive/1/500380/30/0/threaded; http://www.securityfocus.com/bid/29934
CVE: CVE-2008-2877
Published: 2008-06-26
Description: PHP remote file inclusion vulnerability in admin/include/lib.module.php in cmsWorks 2.2 RC4, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the mod_root parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://www.securityfocus.com/bid/29911; https://exchange.xforce.ibmcloud.com/vulnerabilities/43310; https://www.exploit-db.com/exploits/5921
CVE: CVE-2008-2878
Published: 2008-06-26
Description: Open redirect vulnerability in rss_getfile.php in Academic Web Tools (AWT YEKTA) 1.4.3.1, and 1.4.2.8 and earlier, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the file parameter.
CVSS Score: 6.4 (MEDIUM)
References: http://secunia.com/advisories/30763; http://securityreason.com/securityalert/3959; http://www.bugreport.ir/?/44
CVE: CVE-2008-2879
Published: 2008-06-26
Description: Benja CMS 0.1 does not require authentication for access to admin/, which allows remote attackers to add or delete a menu.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-287
References: http://secunia.com/advisories/30834; http://securityreason.com/securityalert/3958; http://www.securityfocus.com/archive/1/493568/100/0/threaded
CVE: CVE-2008-2880
Published: 2008-06-26
Description: Heap-based buffer overflow in the IBM AFP Viewer Plug-in 2.0.7.1 and 3.2.1.1 allows remote attackers to execute arbitrary code via a long SRC property value.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/27995; http://www.vupen.com/english/advisories/2008/1946/references; https://exchange.xforce.ibmcloud.com/vulnerabilities/43338
CVE: CVE-2008-2881
Published: 2008-06-26
Description: Relative Real Estate Systems 3.0 and earlier stores passwords in cleartext in a MySQL database, which allows context-dependent attackers to obtain sensitive information.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://e-rdc.org/v1/news.php?readmore=101; https://www.exploit-db.com/exploits/5924; http://e-rdc.org/v1/news.php?readmore=101
CVE: CVE-2008-2882
Published: 2008-06-26
Description: upgrade.asp in sHibby sHop 2.2 and earlier does not require administrative authentication, which allows remote attackers to update a file or have unspecified other impact via a direct request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/30787; http://securityreason.com/securityalert/3962; https://exchange.xforce.ibmcloud.com/vulnerabilities/43296
CVE: CVE-2008-2883
Published: 2008-06-26
Description: PHP remote file inclusion vulnerability in include/plugins/jrBrowser/payment.php in Jamroom 3.3.0 through 3.3.5 allows remote attackers to execute arbitrary PHP code via a URL in the jamroom[jm_dir] parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/30806; http://www.jamroom.net/; http://www.jamroom.net/index.php?m=td_tracker&o=view&id=1130
CVE: CVE-2008-2884
Published: 2008-06-27
Description: PHP remote file inclusion vulnerability in display.php in RSS-aggregator allows remote attackers to execute arbitrary PHP code via a URL in the path parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/30768; http://www.securityfocus.com/archive/1/493650/100/0/threaded; http://www.securityfocus.com/bid/29873
CVE: CVE-2008-2885
Published: 2008-06-27
Description: PHP remote file inclusion vulnerability in src/browser/resource/categories/resource_categories_view.php in Open Digital Assets Repository System (ODARS) 1.0.2, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the CLASSES_ROOT parameter.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/30784; http://www.securityfocus.com/bid/29881; https://exchange.xforce.ibmcloud.com/vulnerabilities/43285
CVE: CVE-2008-2886
Published: 2008-06-27
Description: PHP remote file inclusion vulnerability in include/plugins/jrBrowser/purchase.php in Jamroom 3.3.0 through 3.3.5, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the jamroom[jm_dir] parameter.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/30806; http://securityreason.com/securityalert/3961; http://www.jamroom.net/
CVE: CVE-2008-2887
Published: 2008-06-27
Description: Directory traversal vulnerability in index.php in chaozz@work FubarForum 1.5 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the page parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/30811; http://www.securityfocus.com/bid/29847; https://exchange.xforce.ibmcloud.com/vulnerabilities/43228
CVE: CVE-2008-2888
Published: 2008-06-27
Description: Multiple PHP remote file inclusion vulnerabilities in MiGCMS 2.0.5, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[application][app_root] parameter to (1) collection.class.php and (2) content_image.class.php in lib/obj/.
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/30770; http://www.securityfocus.com/bid/29874; https://exchange.xforce.ibmcloud.com/vulnerabilities/43250
CVE: CVE-2008-2889
Published: 2008-06-27
Description: Directory traversal vulnerability in the FTP client in AceBIT WISE-FTP 4.1.0 and 5.5.8 allows remote FTP servers to create or overwrite arbitrary files via a ..\ (dot dot backslash) in a response to a LIST command, a related issue to CVE-2002-1345.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/30663; http://secunia.com/advisories/30788; http://vuln.sg/wiseftp558-en.html
CVE: CVE-2008-2890
Published: 2008-06-27
Description: Multiple SQL injection vulnerabilities in Online Fantasy Football League (OFFL) 0.2.6 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) fflteam_id parameter to teams.php, the (2) league_id parameter to leagues.php, and the (3) player_id parameter to players.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30795; http://securityreason.com/securityalert/3960; http://www.securityfocus.com/bid/29861
CVE: CVE-2008-2891
Published: 2008-06-27
Description: SQL injection vulnerability in index.php in eMuSOFT emuCMS 0.3 allows remote attackers to execute arbitrary SQL commands via the cat_id parameter in a category action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30804; http://www.securityfocus.com/bid/29855; https://exchange.xforce.ibmcloud.com/vulnerabilities/43269
CVE: CVE-2008-2892
Published: 2008-06-27
Description: SQL injection vulnerability in the EXP Shop (com_expshop) component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter in a show_payment action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30791; http://www.securityfocus.com/bid/29869; https://exchange.xforce.ibmcloud.com/vulnerabilities/43246
CVE: CVE-2008-2893
Published: 2008-06-27
Description: SQL injection vulnerability in news.php in AJ Square aj-hyip (aka AJ HYIP Acme) allows remote attackers to execute arbitrary SQL commands via the id parameter, a different vector than CVE-2008-2532.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30794; http://www.securityfocus.com/bid/29863; https://exchange.xforce.ibmcloud.com/vulnerabilities/43247
CVE: CVE-2008-2894
Published: 2008-06-27
Description: Directory traversal vulnerability in the FTP client in NCH Software Classic FTP 1.02 for Windows allows remote FTP servers to create or overwrite arbitrary files via a .. (dot dot) in a response to a LIST command, a related issue to CVE-2002-1345.
CVSS Score: 9.3 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/30708; http://vuln.sg/classicftp102-en.html; http://www.securityfocus.com/bid/29846
CVE: CVE-2008-2895
Published: 2008-06-27
Description: Directory traversal vulnerability in index.php in AproxEngine 5.1.0.4 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the page parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/30800; http://www.securityfocus.com/bid/29860; https://exchange.xforce.ibmcloud.com/vulnerabilities/43245
CVE: CVE-2008-2896
Published: 2008-06-27
Description: Directory traversal vulnerability in index.php in FireAnt 1.3 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the page parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://www.securityfocus.com/bid/29843; https://exchange.xforce.ibmcloud.com/vulnerabilities/43229; https://www.exploit-db.com/exploits/5871
CVE: CVE-2008-2897
Published: 2008-06-27
Description: SQL injection vulnerability in index.php in PageSquid CMS 0.3 Beta allows remote attackers to execute arbitrary SQL commands via the page parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/29870; https://exchange.xforce.ibmcloud.com/vulnerabilities/43252; https://www.exploit-db.com/exploits/5899
CVE: CVE-2008-2898
Published: 2008-06-27
Description: Directory traversal vulnerability in includes/header.php in Hedgehog-CMS 1.21 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the c_temp_path parameter. NOTE: in some environments, this can be leveraged for remote file inclusion by using a UNC share pathname or an ftp, ftps, or ssh2.sftp URL.
CVSS Score: 9.3 (HIGH)
CWE: CWE-22
References: http://osvdb.org/46480; http://secunia.com/advisories/30778; https://exchange.xforce.ibmcloud.com/vulnerabilities/43277
CVE: CVE-2008-2899
Published: 2008-06-27
Description: Unspecified vulnerability in includes/classes/page.php in j00lean-CMS 1.03 has unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/30703; http://sourceforge.net/project/shownotes.php?release_id=608171; http://www.securityfocus.com/bid/29885
CVE: CVE-2008-2900
Published: 2008-06-27
Description: SQL injection vulnerability in item.php in PHPAuction 3.2 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/29864; https://exchange.xforce.ibmcloud.com/vulnerabilities/43262; https://www.exploit-db.com/exploits/5892
CVE: CVE-2008-2901
Published: 2008-06-30
Description: Multiple SQL injection vulnerabilities in Haudenschilt Family Connections CMS (FCMS) 1.4 allow remote authenticated users to execute arbitrary SQL commands via the (1) address parameter to addressbook.php, the (2) getnews parameter to familynews.php, and the (3) poll_id parameter to home.php in a results action.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/30680; http://www.securityfocus.com/bid/29722; https://exchange.xforce.ibmcloud.com/vulnerabilities/43097
CVE: CVE-2008-2902
Published: 2008-06-30
Description: SQL injection vulnerability in profile.php in AlstraSoft AskMe Pro 2.1 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.  NOTE: The que_id parameter to forum_answer.php is already covered by CVE-2007-4085.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30672; http://www.securityfocus.com/bid/29732; https://exchange.xforce.ibmcloud.com/vulnerabilities/43106
CVE: CVE-2008-2903
Published: 2008-06-30
Description: SQL injection vulnerability in news.php in Advanced Webhost Billing System (AWBS) 2.3.3 through 2.7.1, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the viewnews parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/30646; http://www.securityfocus.com/bid/29721; https://exchange.xforce.ibmcloud.com/vulnerabilities/43110
CVE: CVE-2008-2904
Published: 2008-06-30
Description: SQL injection vulnerability in shop.php in Conkurent PHPMyCart allows remote attackers to execute arbitrary SQL commands via the cat parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30679; http://www.securityfocus.com/bid/29726; https://exchange.xforce.ibmcloud.com/vulnerabilities/43084
CVE: CVE-2008-2905
Published: 2008-06-30
Description: PHP remote file inclusion vulnerability in includes/Cache/Lite/Output.php in the Cache_Lite package in Mambo 4.6.4 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/30685; http://www.securityfocus.com/bid/29716; http://www.securitytracker.com/id?1020295
CVE: CVE-2008-2906
Published: 2008-06-30
Description: SQL injection vulnerability in lista_anexos.php in WebChamado 1.1 allows remote attackers to execute arbitrary SQL commands via the tsk_id parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/30690; http://www.securityfocus.com/bid/29711; https://exchange.xforce.ibmcloud.com/vulnerabilities/43069
CVE: CVE-2008-2907
Published: 2008-06-30
Description: SQL injection vulnerability in admin/index.php in WebChamado 1.1, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the eml parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/30690; http://www.securityfocus.com/bid/29701; https://exchange.xforce.ibmcloud.com/vulnerabilities/43060
CVE: CVE-2008-2908
Published: 2008-06-30
Description: Multiple stack-based buffer overflows in a certain ActiveX control in ienipp.ocx in Novell iPrint Client for Windows before 4.36 allow remote attackers to execute arbitrary code via a long value of the (1) operation, (2) printer-url, or (3) target-frame parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/30709; http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5028061.html; http://www.kb.cert.org/vuls/id/145313
CVE: CVE-2008-2909
Published: 2008-06-30
Description: SQL injection vulnerability in results.php in Clever Copy 3.0 allows remote attackers to execute arbitrary SQL commands via the searchtype parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30699; http://www.securityfocus.com/bid/29694; http://www.securitytracker.com/id?1020294
CVE: CVE-2008-2910
Published: 2008-06-30
Description: Buffer overflow in the DXTTextOutEffect ActiveX control (aka the Text-Effect DXT Filter), as distributed in TextOut.dll 6.0.18.1 and mvtextout.dll, in muvee autoProducer 6.0 and 6.1 allows remote attackers to execute arbitrary code via a long FontSetting property value.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/30696; http://www.securityfocus.com/bid/29693; https://exchange.xforce.ibmcloud.com/vulnerabilities/43036
CVE: CVE-2008-2911
Published: 2008-06-30
Description: Multiple cross-site scripting (XSS) vulnerabilities in index.php in Contenido 4.8.4 allow remote attackers to inject arbitrary web script or HTML via the (1) contenido, (2) Belang, and (3) username parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/30683; http://www.securityfocus.com/bid/29719; https://exchange.xforce.ibmcloud.com/vulnerabilities/43107
CVE: CVE-2008-2912
Published: 2008-06-30
Description: Multiple PHP remote file inclusion vulnerabilities in Contenido CMS 4.8.4 allow remote attackers to execute arbitrary PHP code via a URL in the (1) contenido_path parameter to (a) contenido/backend_search.php; the (2) cfg[path][contenido] parameter to (b) move_articles.php, (c) move_old_stats.php, (d) optimize_database.php, (e) run_newsletter_job.php, (f) send_reminder.php, (g) session_cleanup.php, and (h) setfrontenduserstate.php in contenido/cronjobs/, and (i) includes/include.newsletter_jobs_subnav.php and (j) plugins/content_allocation/includes/include.right_top.php in contenido/; the (3) cfg[path][templates] parameter to (k) includes/include.newsletter_jobs_subnav.php and (l) plugins/content_allocation/includes/include.right_top.php in contenido/; and the (4) cfg[templates][right_top_blank] parameter to (m) plugins/content_allocation/includes/include.right_top.php and (n) contenido/includes/include.newsletter_jobs_subnav.php in contenido/, different vectors than CVE-2006-5380.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/30683; http://www.securityfocus.com/bid/29719; https://exchange.xforce.ibmcloud.com/vulnerabilities/43103
CVE: CVE-2008-2913
Published: 2008-06-30
Description: Directory traversal vulnerability in func.php in Devalcms 1.4a, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the currentpath parameter, in conjunction with certain ... (triple dot) and ..... sequences in the currentfile parameter, to index.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/30585; http://www.securityfocus.com/bid/29728; https://exchange.xforce.ibmcloud.com/vulnerabilities/43116
CVE: CVE-2008-2914
Published: 2008-06-30
Description: SQL injection vulnerability in jobseekers/JobSearch3.php (aka the search module) in PHP JOBWEBSITE PRO allows remote attackers to execute arbitrary SQL commands via the (1) kw or (2) position parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30686; http://www.securityfocus.com/archive/1/493374/100/0/threaded; http://www.securityfocus.com/bid/29713
CVE: CVE-2008-2915
Published: 2008-06-30
Description: Multiple SQL injection vulnerabilities in jobseekers/JobSearch.php (aka the search module) in Pre Job Board allow remote attackers to execute arbitrary SQL commands via the (1) position or (2) kw parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30684; http://www.securityfocus.com/bid/29717; http://www.spanish-hackers.com/vuln/joss-42.txt
CVE: CVE-2008-2916
Published: 2008-06-30
Description: Multiple SQL injection vulnerabilities in Pre ADS Portal 2.0 and earlier, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) cid parameter to showcategory.php and the (2) id parameter to software-description.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://e-rdc.org/v1/news.php?readmore=98; http://secunia.com/advisories/30689; http://securityreason.com/securityalert/3963
CVE: CVE-2008-2917
Published: 2008-06-30
Description: SQL injection vulnerability in productsofcat.asp in E-SMART CART allows remote attackers to execute arbitrary SQL commands via the category_id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30687; http://securityreason.com/securityalert/3964; http://www.securityfocus.com/archive/1/493372/100/0/threaded
CVE: CVE-2008-2918
Published: 2008-06-30
Description: SQL injection vulnerability in details.php in Application Dynamics Cartweaver 3.0 allows remote attackers to execute arbitrary SQL commands via the prodId parameter, possibly a related issue to CVE-2006-2046.3.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30677; http://www.securityfocus.com/bid/29727; https://exchange.xforce.ibmcloud.com/vulnerabilities/43099
CVE: CVE-2008-2919
Published: 2008-06-30
Description: SQL injection vulnerability in listing.php in Gryphon gllcTS2 4.2.4 allows remote attackers to execute arbitrary SQL commands via the sort parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/30688; http://www.securityfocus.com/bid/29714; https://exchange.xforce.ibmcloud.com/vulnerabilities/43089
CVE: CVE-2008-2920
Published: 2008-06-30
Description: admin/filemanager/ (aka the File Manager) in EZTechhelp EZCMS 1.2 and earlier does not require authentication, which allows remote attackers to create, modify, read, and delete files.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://ezcms.eztechhelp.com/index.php?page=3&nid=27; http://www.securityfocus.com/bid/29738; https://exchange.xforce.ibmcloud.com/vulnerabilities/43091
CVE: CVE-2008-2921
Published: 2008-06-30
Description: SQL injection vulnerability in index.php in EZTechhelp EZCMS 1.2 and earlier allows remote attackers to execute arbitrary SQL commands via the page parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://ezcms.eztechhelp.com/index.php?page=3&nid=27; http://secunia.com/advisories/30674; http://www.securityfocus.com/bid/29737