deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2005-3820
Published: 2005-11-26
Description: Multiple directory traversal vulnerabilities in index.php in vTiger CRM 4.2 and earlier allow remote attackers to read or include arbitrary files, an ultimately execute arbitrary PHP code, via .. (dot dot) and null byte ("%00") sequences in the (1) module parameter and (2) action parameter in the Leads module, as also demonstrated by injecting PHP code into log messages and accessing the log file.
CVSS Score: 6.4 (MEDIUM)
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]1951&w=2; http://secunia.com/advisories/17693; http://securitytracker.com/id?1015271
CVE: CVE-2005-3821
Published: 2005-11-26
Description: Cross-site scripting (XSS) vulnerability in vTiger CRM 4.2 and earlier allows remote attackers to inject arbitrary web script or HTML via multiple vectors, including the account name.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]1951&w=2; http://secunia.com/advisories/17693; http://securitytracker.com/id?1015274
CVE: CVE-2005-3822
Published: 2005-11-26
Description: Multiple SQL injection vulnerabilities in vTiger CRM 4.2 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) username in the login form or (2) record parameter, as demonstrated in the EditView action for the Contacts module.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]1951&w=2; http://secunia.com/advisories/17693; http://securityreason.com/securityalert/203
CVE: CVE-2005-3823
Published: 2005-11-26
Description: The Users module in vTiger CRM 4.2 and earlier allows remote attackers to execute arbitrary PHP code via an arbitrary file in the templatename parameter, which is passed to the eval function.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]1951&w=2; http://secunia.com/advisories/17693; http://securitytracker.com/id?1015274
CVE: CVE-2005-3824
Published: 2005-11-26
Description: The uploads module in vTiger CRM 4.2 and earlier allows remote attackers to upload arbitrary files, such as PHP files, via the add2db action.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]1951&w=2; http://secunia.com/advisories/17693; http://securitytracker.com/id?1015274
CVE: CVE-2005-3825
Published: 2005-11-26
Description: SQL injection vulnerability in index.php in Comdev Vote Caster 3.1 and earlier allows remote attackers to execute arbitrary SQL commands via the campaign_id parameter in a result action.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2005/11/vote-caster-3x-sql-inj-vuln.html; http://secunia.com/advisories/17672; http://www.osvdb.org/21087
CVE: CVE-2005-3826
Published: 2005-11-26
Description: Multiple SQL injection vulnerabilities in Ezyhelpdesk 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) edit_id, (2) faq_id, and (3) c_id parameters in a query string, and (4) the search engine, possibly involving the search_string parameter.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2005/11/ezyhelpdesk-multiple-sql-inj.html; http://secunia.com/advisories/17696; http://www.osvdb.org/21075
CVE: CVE-2005-3827
Published: 2005-11-26
Description: SQL injection vulnerability in product_cat in AgileBill 1.4.92 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2005/11/agilebill-14x-id-sql-injection.html; http://secunia.com/advisories/17723; http://securitytracker.com/id?1015272
CVE: CVE-2005-3828
Published: 2005-11-26
Description: SQL injection vulnerability in index.php in ActiveCampaign KnowledgeBuilder 2.4 and earlier allows remote attackers to execute arbitrary SQL commands via the article parameter.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2005/11/activecampaign-knowledgebuilder-vuln.html; http://secunia.com/advisories/17732; http://www.osvdb.org/21096
CVE: CVE-2005-3829
Published: 2005-11-26
Description: index.php in ActiveCampaign KnowledgeBuilder 2.4 and earlier allows remote attackers to cause a denial of service (CPU consumption) via an invalid category parameter, which causes a large number of SQL queries to be processed.
CVSS Score: 7.8 (HIGH)
References: http://pridels0.blogspot.com/2005/11/activecampaign-knowledgebuilder-vuln.html; http://secunia.com/advisories/17732; http://www.osvdb.org/21098
CVE: CVE-2005-3830
Published: 2005-11-26
Description: index.php in ActiveCampaign SupportTrio 1.4 and earlier allows remote attackers to read or include arbitrary files via the page parameter, possibly due to a directory traversal vulnerability.
CVSS Score: 5.0 (MEDIUM)
References: http://pridels0.blogspot.com/2005/11/activecampaign-supporttrio-local-file.html; http://secunia.com/advisories/17731; http://www.osvdb.org/21101
CVE: CVE-2005-3831
Published: 2005-11-26
Description: Stack-based buffer overflow in (1) CxZIP60.dll and (2) CxZIP60u.dll, as used in SpeedProject products including (a) ZipStar 5.0 Build 4285, (b) Squeez 5.0 Build 4285, and (c) SpeedCommander 11.0 Build 4430 and 10.51 Build 4430, allows user-assisted attackers to execute arbitrary code via a ZIP archive containing a long filename.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-119
References: http://secunia.com/advisories/17420; http://secunia.com/secunia_research/2005-60/advisory; http://securitytracker.com/id?1015265
CVE: CVE-2005-3832
Published: 2005-11-26
Description: Stack-based buffer overflow in (1) CxUux60.dll and (2) CxUux60u.dll, as used in SpeedProject products including (a) Squeez 5.0 Build 4285, and (b) SpeedCommander 11.0 Build 4430 and 10.51 Build 4430, allows user-assisted attackers to execute arbitrary code via a ZIP archive containing a long filename.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-119
References: http://secunia.com/advisories/17420; http://secunia.com/secunia_research/2005-60/advisory; http://securityreason.com/securityalert/204
CVE: CVE-2005-3833
Published: 2005-11-26
Description: SQL injection vulnerability in songinfo.php in Tunez 1.21 and earlier allows remote attackers to execute arbitrary SQL commands via the song_id parameter.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2005/11/tunez-sql-and-xss-vuln.html; http://secunia.com/advisories/17692; http://www.osvdb.org/21062
CVE: CVE-2005-3834
Published: 2005-11-26
Description: Cross-site scripting (XSS) vulnerability in search.php in Tunez 1.21 and earlier allows remote attackers to inject arbitrary web script or HTML via the searchFor parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2005/11/tunez-sql-and-xss-vuln.html; http://secunia.com/advisories/17692; http://www.osvdb.org/21063
CVE: CVE-2005-3835
Published: 2005-11-26
Description: PHP remote file inclusion vulnerability in support/index.php in DeskLance 2.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the main parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://pridels0.blogspot.com/2005/11/desklance-vuln.html; http://secunia.com/advisories/17730; http://www.vupen.com/english/advisories/2005/2575
CVE: CVE-2005-3836
Published: 2005-11-26
Description: SQL injection vulnerability in DeskLance 2.3 and earlier allows remote attackers to execute arbitrary SQL commands via the announce parameter.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2005/11/desklance-vuln.html; http://secunia.com/advisories/17730; http://www.vupen.com/english/advisories/2005/2575
CVE: CVE-2005-3837
Published: 2005-11-26
Description: Cross-site scripting (XSS) vulnerability in the search module in sCssBoard 1.2 and 1.12, and earlier versions, allows remote attackers to inject arbitrary web script or HTML via the search_term parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2005/11/scssboard-xss-vuln-in-search-param.html; http://secunia.com/advisories/17716; http://www.osvdb.org/21089
CVE: CVE-2005-3838
Published: 2005-11-26
Description: Multiple SQL injection vulnerabilities in search.php in IsolSoft Support Center 2.2 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) lorder, (2) Priority, (3) Status, (4) Category, (5) searchvalue, and (6) field parameter.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2005/11/isolsoft-support-center-sql-inj.html; http://secunia.com/advisories/17728; http://securitytracker.com/id?1015270
CVE: CVE-2005-3839
Published: 2005-11-26
Description: Cross-site scripting (XSS) vulnerability in SupportPRO Supportdesk allows remote attackers to inject arbitrary web script or HTML via the (1) post tickers and (2) view tickets options.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2005/11/supportpro-supportdesk-xss-vuln.html; http://secunia.com/advisories/17701; http://www.osvdb.org/21088
CVE: CVE-2005-3840
Published: 2005-11-26
Description: SQL injection vulnerability in kb.php in Omnistar Live 5.2 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) id and (2) category_id parameter.  NOTE: due to a typo, an Internet Explorer issue was incorrectly assigned this identifier, but the correct identifier is CVE-2005-3240.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://pridels0.blogspot.com/2005/11/omnistar-live-id-and-categoryid-sql.html; http://secunia.com/advisories/17697; http://www.osvdb.org/21077
CVE: CVE-2005-3841
Published: 2005-11-26
Description: Cross-site scripting (XSS) vulnerability in kPlaylist 1.6 (build 400), and possibly other versions, allows remote attackers to inject arbitrary web script or HTML via the searchfor search parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2005/11/kplaylist-xss-vuln.html; http://secunia.com/advisories/17689; http://www.osvdb.org/21069
CVE: CVE-2005-3842
Published: 2005-11-26
Description: SQL injection vulnerability in index.php in pdjk-support suite 1.1a and earlier allows remote attackers to execute arbitrary SQL commands via the (1) rowstart, (2) news_id, and (3) faq_id parameters.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2005/11/pdjk-support-suite-sql-inj.html; http://secunia.com/advisories/17722; http://www.osvdb.org/21099
CVE: CVE-2005-3843
Published: 2005-11-26
Description: SQL injection vulnerability in faq.php in Nicecoder iDesk 1.0 allows remote attackers to execute arbitrary SQL commands via the cat_id parameter.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2005/11/idesk-catid-sql-inj.html; http://secunia.com/advisories/17729; http://www.osvdb.org/21117
CVE: CVE-2005-3844
Published: 2005-11-26
Description: SQL injection vulnerability in phpWordPress PHP News and Article Manager 3.0 allows remote attackers to execute arbitrary SQL commands via the (1) poll and (2) category parameters to index.php, and (3) the ctg parameter in an archive action.
CVSS Score: 7.5 (HIGH)
References: http://forum.word-press.net/index.php?&showtopic=76&st=0&#entry181; http://pridels0.blogspot.com/2005/11/phpwordpress-30-sql-inj.html; http://secunia.com/advisories/17733
CVE: CVE-2005-3845
Published: 2005-11-26
Description: SQL injection vulnerability in invoices.php in EZ Invoice Inc 2.0 allows remote attackers to execute arbitrary SQL commands via the i parameter.  NOTE: the vendor has stated "EZ Invoice, Inc has a patah available.  Please email support@ezinvoiceinc.com and EZI will email you the patch to fix this small issue."
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://pridels0.blogspot.com/2005/11/ez-invoice-inc-v-20-sql-inj.html; http://www.osvdb.org/21369; http://www.securityfocus.com/bid/16133
CVE: CVE-2005-3846
Published: 2005-11-26
Description: SQL injection vulnerability in news.php in Fantastic News 2.1.1 and earlier allows remote attackers to execute arbitrary SQL commands via the category parameter.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2005/11/fantastic-news-category-sql-inj.html; http://secunia.com/advisories/17758; http://www.osvdb.org/21162
CVE: CVE-2005-3847
Published: 2005-11-27
Description: The handle_stop_signal function in signal.c in Linux kernel 2.6.11 up to other versions before 2.6.13 and 2.6.12.6 allows local users to cause a denial of service (deadlock) by sending a SIGKILL to a real-time threaded process while it is performing a core dump.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-667
References: http://lists.suse.de/archive/suse-security-announce/2006-Feb/0010.html; http://marc.info/?l=linux-kernel&m=[PII_REDACTED]3450&w=2; http://marc.info/?l=linux-kernel&m=[PII_REDACTED]6574&w=2
CVE: CVE-2005-3848
Published: 2005-11-27
Description: Memory leak in the icmp_push_reply function in Linux 2.6 before 2.6.12.6 and 2.6.13 allows remote attackers to cause a denial of service (memory consumption) via a large number of crafted packets that cause the ip_append_data function to fail, aka "DST leak in icmp_push_reply."
CVSS Score: 7.8 (HIGH)
References: http://lists.suse.de/archive/suse-security-announce/2006-Feb/0010.html; http://marc.info/?l=linux-kernel&m=[PII_REDACTED]6937&w=2; http://marc.info/?l=linux-kernel&m=[PII_REDACTED]8917&w=2
CVE: CVE-2005-3849
Published: 2005-11-27
Description: Cross-site scripting (XSS) vulnerability in the Search module in PmWiki up to 2.0.12 allows remote attackers to inject arbitrary web script or HTML via the q parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://moritz-naumann.com/adv/0005/pmwiki/0005.txt; http://secunia.com/advisories/17707; http://securityreason.com/securityalert/201
CVE: CVE-2005-3850
Published: 2005-11-27
Description: Cross-site scripting (XSS) vulnerability in search.asp in Online Knowledge Base System (OKBSYS) Lite Edition 1.0 allows remote attackers to inject arbitrary web script or HTML via hex-encoded values in the q parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2005/11/okbsys-lite-10-searchasp-xss-vuln.html; http://secunia.com/advisories/17713; http://www.osvdb.org/21094
CVE: CVE-2005-3851
Published: 2005-11-27
Description: Cross-site scripting (XSS) vulnerability in search.asp in Online Attendance System (OASYS) Lite 1.0 allows remote attackers to inject arbitrary web script or HTML via certain search parameters, possibly the keyword parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2005/11/oasys-lite-10-searchasp-xss-vuln.html; http://secunia.com/advisories/17712; http://www.osvdb.org/21095
CVE: CVE-2005-3852
Published: 2005-11-27
Description: SQL injection vulnerability in search.asp in Online Work Order Suite (OWOS) Lite Edition for ASP 3.0 allows remote attackers to execute arbitrary SQL commands via the keyword parameter.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2005/11/owos-lite-30-sql-inj.html; http://secunia.com/advisories/17711; http://www.osvdb.org/21116
CVE: CVE-2005-3853
Published: 2005-11-27
Description: SQL injection vulnerability in snews.php in sNews 1.3 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) id and (2) category parameters to index.php.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2005/11/snews-13-sql-injection.html; http://secunia.com/advisories/17688; http://www.osvdb.org/21093
CVE: CVE-2005-3854
Published: 2005-11-27
Description: Cross-site scripting (XSS) vulnerability in index.php in EasyPageCMS allows remote attackers to inject arbitrary web script or HTML via the cat parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://packetstorm.linuxsecurity.com/0511-exploits/EasyPageCMSXSS.txt; http://securitytracker.com/id?1015211; http://www.osvdb.org/21007
CVE: CVE-2005-3855
Published: 2005-11-27
Description: SQL injection vulnerability in process.php in 1-2-3 music store allows remote attackers to execute arbitrary SQL commands via the AlbumID parameter.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2005/11/1-2-3-music-store-albumid-sql.html; http://secunia.com/advisories/17683; http://www.osvdb.org/21074
CVE: CVE-2005-3856
Published: 2005-11-27
Description: The Popular URL capability (popularurls.cpp) in Krusader 1.60.0 and 1.70.0-beta1 saves passwords in cleartext in the krusaderrc file when the user enters URLs containing passwords in the panel URL field, which might allow attackers to access other sites.
CVSS Score: 4.0 (MEDIUM)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=336169; http://www.krusader.org/phpBB/viewtopic.php?t=1367; http://www.krusader.org/phpBB/viewtopic.php?t=1368
CVE: CVE-2005-3857
Published: 2005-11-27
Description: The time_out_leases function in locks.c for Linux kernel before 2.6.15-rc3 allows local users to cause a denial of service (kernel log message consumption) by causing a large number of broken leases, which is recorded to the log using the printk function.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-399
References: ftp://patches.sgi.com/support/free/security/advisories/20060402-01-U; http://marc.info/?l=linux-kernel&m=[PII_REDACTED]0568&w=2; http://marc.info/?l=linux-kernel&m=[PII_REDACTED]1622&w=2
CVE: CVE-2005-3858
Published: 2005-11-27
Description: Memory leak in the ip6_input_finish function in ip6_input.c in Linux kernel 2.6.12 and earlier might allow attackers to cause a denial of service via malformed IPv6 packets with unspecified parameter problems, which prevents the SKB from being freed.
CVSS Score: 7.8 (HIGH)
References: http://lists.suse.de/archive/suse-security-announce/2006-Feb/0010.html; http://marc.info/?l=linux-kernel&m=[PII_REDACTED]0081&w=2; http://marc.info/?l=linux-kernel&m=[PII_REDACTED]9033&w=2
CVE: CVE-2005-3859
Published: 2005-11-29
Description: PHP remote file inclusion vulnerability in q-news.php in Q-News 2.0 allows remote attackers to execute arbitrary PHP code via a URL in the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/17771; http://securityreason.com/securityalert/209; http://securitytracker.com/id?1015277
CVE: CVE-2005-3860
Published: 2005-11-29
Description: PHP remote file inclusion vulnerability in athena.php in Oliver May Athena PHP Website Administration 0.1a allows remote attackers to execute arbitrary PHP code via a URL in the athena_dir parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://securityreason.com/securityalert/208; http://securitytracker.com/id?1015278; http://sourceforge.net/forum/forum.php?forum_id=514746
CVE: CVE-2005-3861
Published: 2005-11-29
Description: PHP remote file inclusion vulnerability in content.php in phpGreetz 0.99 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the content parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://securityreason.com/securityalert/210; http://securitytracker.com/id?1015276; http://www.securityfocus.com/archive/1/417798/100/0/threaded
CVE: CVE-2005-3862
Published: 2005-11-29
Description: Buffer overflow in unalz before 0.53 allows remote attackers to execute arbitrary code via long file names in ALZ archives.
CVSS Score: 7.5 (HIGH)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=340842; http://secunia.com/advisories/17774; http://secunia.com/advisories/18665
CVE: CVE-2005-3863
Published: 2005-11-29
Description: Stack-based buffer overflow in kkstrtext.h in ktools library 0.3 and earlier, as used in products such as (1) centericq, (2) orpheus, (3) motor, and (4) groan, allows local users or remote attackers to execute arbitrary code via a long parameter to the VGETSTRING macro.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/17768; http://secunia.com/advisories/18081; http://secunia.com/advisories/20329
CVE: CVE-2005-3864
Published: 2005-11-29
Description: SQL injection vulnerability in index.php in SourceWell 1.1.2 and earlier allows remote attackers to execute arbitrary SQL commands via the cnt parameter.  NOTE: various reports indicate that the affected version is 1.1.3, but as of 2005-11-29, the most recent version appears to be 1.1.2.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2005/11/sourcewell-sql-inj-vuln.html; http://secunia.com/advisories/17673; http://www.osvdb.org/21130
CVE: CVE-2005-3865
Published: 2005-11-29
Description: SQL injection vulnerability in index.php in AllWeb search 3.0 and earlier allows remote attackers to execute arbitrary SQL commands via the search parameter.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2005/11/allweb-search-sql-inj-vuln.html; http://secunia.com/advisories/17709; http://www.osvdb.org/21129
CVE: CVE-2005-3866
Published: 2005-11-29
Description: Cross-site scripting (XSS) vulnerability in SearchFeed Search Engine 1.3.2 and earlier allows remote attackers to inject arbitrary HTML and web script, possibly via the REQ parameter, which is used when performing a search.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2005/11/searchfeed-search-engine-xss-vuln.html; http://secunia.com/advisories/17715; http://www.osvdb.org/21144
CVE: CVE-2005-3867
Published: 2005-11-29
Description: Cross-site scripting (XSS) vulnerability in RevenuePilot Search Engine Script 1.2.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the REQ parameter, which is used when performing a search.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2005/11/revenuepilot-search-engine-xss-vuln.html; http://secunia.com/advisories/17717; http://www.osvdb.org/21143
CVE: CVE-2005-3868
Published: 2005-11-29
Description: Multiple SQL injection vulnerabilities in K-Search 1.0 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) term, (2) id, (3) stat, and (4) source parameters to index.php, and (5) through the image parameters with an add request.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2005/11/k-search-multiple-vuln.html; http://secunia.com/advisories/17719; http://www.exploit-db.com/exploits/13993
CVE: CVE-2005-3869
Published: 2005-11-29
Description: Cross-site scripting (XSS) vulnerability in index.php in Google API Search 1.3.1 and earlier allows remote attackers to inject arbitrary web script or HTML via hex-encoded values in the REQ parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2005/11/google-api-search-xss-vuln.html; http://secunia.com/advisories/17725; http://www.osvdb.org/21145
CVE: CVE-2005-3870
Published: 2005-11-29
Description: Multiple SQL injection vulnerabilities in edmobbs9r.php in edmoBBS 0.9 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) table and (2) messageID parameters.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2005/11/edmobbs-sql-inj-vuln.html; http://secunia.com/advisories/17726; http://www.osvdb.org/21132
CVE: CVE-2005-3871
Published: 2005-11-29
Description: Multiple SQL injection vulnerabilities in Joels Bulletin board (JBB) 0.9.9rc3 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) nr parameter in topiczeigen.php, (2) forum and (3) zeigeseite parameters in showforum.php, (4) forum parameter in newtopic.php, and (5) tidnr parameter in neuerbeitrag.php.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2005/11/jbb-sql-inj-vuln.html; http://secunia.com/advisories/17727; http://www.osvdb.org/21148
CVE: CVE-2005-3872
Published: 2005-11-29
Description: Multiple SQL injection vulnerabilities in Ugroup 2.6.2 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) FORUM_ID parameter in forum.php, and the (2) TOPIC_ID, (3) FORUM_ID, and (4) CAT_ID parameters in topic.php.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2005/11/ugroup-262-sql-inj-vuln.html; http://secunia.com/advisories/17734; http://www.osvdb.org/21152
CVE: CVE-2005-3873
Published: 2005-11-29
Description: SQL injection vulnerability in topic.php in ShockBoard 3.0 and 4.0 allows remote attackers to execute arbitrary SQL commands via the offset parameter.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2005/11/shockboard-sql-inj-vuln.html; http://secunia.com/advisories/17735; http://www.osvdb.org/21138