deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2010-4995
Published: 2011-11-01
Description: SQL injection vulnerability in the NeoRecruit (com_neorecruit) component 1.6.4 for Joomla! allows remote attackers to execute arbitrary SQL commands via the Itemid parameter in an offer_view action to index.php, a different vector than CVE-2007-4506.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1007-exploits/joomlaneorecruit-sql.txt; http://securityreason.com/securityalert/8499; http://www.exploit-db.com/exploits/14250
CVE: CVE-2010-4996
Published: 2011-11-01
Description: SQL injection vulnerability in ogp_show.php in esoftpro Online Guestbook Pro 5.1 allows remote attackers to execute arbitrary SQL commands via the search parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/14204; http://www.securityfocus.com/bid/41363; http://www.vupen.com/english/advisories/2010/1697
CVE: CVE-2010-4999
Published: 2011-11-01
Description: SQL injection vulnerability in index.php in esoftpro Online Photo Pro 2.0 allows remote attackers to execute arbitrary SQL commands via the section parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/14205; http://www.securityfocus.com/bid/41370; http://www.vupen.com/english/advisories/2010/1698
CVE: CVE-2010-5001
Published: 2011-11-01
Description: SQL injection vulnerability in view.php in esoftpro Online Contact Manager 3.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/14206; http://www.securityfocus.com/bid/41373; http://www.vupen.com/english/advisories/2010/1700
CVE: CVE-2010-5002
Published: 2011-11-01
Description: Cross-site scripting (XSS) vulnerability in modules/slideshowmodule/slideshow.js.php in Exponent CMS 0.97.0 allows remote attackers to inject arbitrary web script or HTML via the u parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/1007-exploits/exponentcms-xss.txt; http://secunia.com/advisories/36703; http://securityreason.com/securityalert/8485
CVE: CVE-2010-5003
Published: 2011-11-01
Description: SQL injection vulnerability in the AutarTimonial (com_autartimonial) component 1.0.8 for Joomla! allows remote attackers to execute arbitrary SQL commands via the limit parameter in an autartimonial action to index.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/66036; http://packetstormsecurity.org/1007-exploits/joomlaautartimonial-sql.txt; http://secunia.com/advisories/40449
CVE: CVE-2011-1918
Published: 2011-11-02
Description: Stack-based buffer overflow in the Data Archiver service in GE Intelligent Platforms Proficy Historian before 3.5 SIM 17 and 4.x before 4.0 SIM 12 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via crafted TCP message traffic.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://ics-cert.us-cert.gov/advisories/ICSA-11-243-03A; http://www.securityfocus.com/bid/50475; http://www.us-cert.gov/control_systems/pdf/ICSA-11-243-03.pdf
CVE: CVE-2011-1919
Published: 2011-11-02
Description: Multiple stack-based buffer overflows in GE Intelligent Platforms Proficy Applications before 4.4.1 SIM 101 and 5.x before 5.0 SIM 43 allow remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via crafted TCP message traffic to (1) PRProficyMgr.exe in Proficy Server Manager, (2) PRGateway.exe in Proficy Server Gateway, (3) PRRDS.exe in Proficy Remote Data Service, or (4) PRLicenseMgr.exe in Proficy Server License Manager.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/50474; http://www.us-cert.gov/control_systems/pdf/ICSA-11-243-01.pdf; http://www.securityfocus.com/bid/50474
CVE: CVE-2011-3165
Published: 2011-11-02
Description: Unspecified vulnerability in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1208.
CVSS Score: 10.0 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3289&w=2; http://securityreason.com/securityalert/8484; http://www.securitytracker.com/id?1026260
CVE: CVE-2011-3166
Published: 2011-11-02
Description: Unspecified vulnerability in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1209.
CVSS Score: 10.0 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3289&w=2; http://securityreason.com/securityalert/8484; http://www.securitytracker.com/id?1026260
CVE: CVE-2011-3167
Published: 2011-11-02
Description: Unspecified vulnerability in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1210.
CVSS Score: 10.0 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3289&w=2; http://securityreason.com/securityalert/8484; http://www.securitytracker.com/id?1026260
CVE: CVE-2011-3320
Published: 2011-11-02
Description: Cross-site scripting (XSS) vulnerability in the Web Administrator component in GE Intelligent Platforms Proficy Historian 4.x and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/50473; http://www.us-cert.gov/control_systems/pdf/ICSA-11-243-02.pdf; http://www.securityfocus.com/bid/50473
CVE: CVE-2011-4074
Published: 2011-11-02
Description: Cross-site scripting (XSS) vulnerability in cmd.php in phpLDAPadmin 1.2.x before 1.2.2 allows remote attackers to inject arbitrary web script or HTML via an _debug command.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://openwall.com/lists/oss-security/2011/10/24/9; http://openwall.com/lists/oss-security/2011/10/25/2; http://osvdb.org/76593
CVE: CVE-2011-4075
Published: 2011-11-02
Description: The masort function in lib/functions.php in phpLDAPadmin 1.2.x before 1.2.2 allows remote attackers to execute arbitrary PHP code via the orderby parameter (aka sortby variable) in a query_engine action to cmd.php, as exploited in the wild in October 2011.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://dev.metasploit.com/redmine/issues/5820; http://openwall.com/lists/oss-security/2011/10/24/9; http://openwall.com/lists/oss-security/2011/10/25/2
CVE: CVE-2010-4971
Published: 2011-11-02
Description: Cross-site scripting (XSS) vulnerability in VideoWhisper PHP 2 Way Video Chat component for Joomla! allows remote attackers to inject arbitrary web script or HTML via the r parameter to index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/1006-exploits/joomlavideowhisper-xss.txt; http://secunia.com/advisories/40193; http://securityreason.com/securityalert/8500
CVE: CVE-2010-4997
Published: 2011-11-02
Description: SQL injection vulnerability in index.php in OlyKit Swoopo Clone 2010 allows remote attackers to execute arbitrary SQL commands via the id parameter in a product action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/40360; http://www.exploit-db.com/exploits/14084; http://secunia.com/advisories/40360
CVE: CVE-2010-4998
Published: 2011-11-02
Description: PHP remote file inclusion vulnerability in ardeaCore/lib/core/ardeaInit.php in ardeaCore PHP Framework 2.2 allows remote attackers to execute arbitrary PHP code via a URL in the pathForArdeaCore parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://packetstormsecurity.org/1006-exploits/ardeacore-rfi.txt; http://secunia.com/advisories/40207; http://securityreason.com/securityalert/8503
CVE: CVE-2010-5000
Published: 2011-11-02
Description: SQL injection vulnerability in login/login_index.php in MCLogin System 1.1 and 1.2 allows remote attackers to execute arbitrary SQL commands via the myusername parameter (aka Username field) in a do_login action.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1006-exploits/mcloginsystem-sql.txt; http://secunia.com/advisories/40122; http://securityreason.com/securityalert/8504
CVE: CVE-2010-5004
Published: 2011-11-02
Description: SQL injection vulnerability in searchvote.php in 2daybiz Polls (aka Advanced Poll) Script allows remote attackers to execute arbitrary SQL commands via the category parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/14074; http://www.securityfocus.com/bid/41172; http://www.exploit-db.com/exploits/14074
CVE: CVE-2010-5005
Published: 2011-11-02
Description: Cross-site scripting (XSS) vulnerability in members/profileCommentsResponse.php in Rayzz Photoz allows remote attackers to inject arbitrary web script or HTML via the profileCommentTextArea parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/40113; http://www.securityfocus.com/bid/40627; http://secunia.com/advisories/40113
CVE: CVE-2010-5006
Published: 2011-11-02
Description: SQL injection vulnerability in googlemap/index.php in EMO Realty Manager allows remote attackers to execute arbitrary SQL commands via the cat1 parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1006-exploits/emorealtymanager-sql.txt; http://securityreason.com/securityalert/8505; http://www.securityfocus.com/bid/40625
CVE: CVE-2010-5007
Published: 2011-11-02
Description: Cross-site scripting (XSS) vulnerability in pages/match_report.php in UTStats Beta 4 and earlier allows remote attackers to inject arbitrary web script or HTML via the mid parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/1006-exploits/utstats-sqlxss.txt; http://securityreason.com/securityalert/8506; http://www.exploit-db.com/exploits/13854
CVE: CVE-2010-5008
Published: 2011-11-02
Description: SQL injection vulnerability in pages/contact_list_mail_form.asp in BrightSuite Groupware 5.4 allows remote attackers to execute arbitrary SQL commands via the ContactID parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1006-exploits/brightsuite-sql.txt; http://securityreason.com/securityalert/8507; http://www.exploit-db.com/exploits/13843/
CVE: CVE-2010-5009
Published: 2011-11-02
Description: SQL injection vulnerability in index.php in UTStats Beta 4 and earlier allows remote attackers to execute arbitrary SQL commands via the pid parameter in a matchp action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1006-exploits/utstats-sqlxss.txt; http://securityreason.com/securityalert/8506; http://www.exploit-db.com/exploits/13854
CVE: CVE-2010-5010
Published: 2011-11-02
Description: Cross-site scripting (XSS) vulnerability in schoolmv2/html/studentmain.php in SchoolMation 2.3 allows remote attackers to inject arbitrary web script or HTML via the session parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/65417; http://packetstormsecurity.org/1006-exploits/schoolmation-sqlxss.txt; http://secunia.com/advisories/40154
CVE: CVE-2010-5011
Published: 2011-11-02
Description: SQL injection vulnerability in schoolmv2/html/studentmain.php in SchoolMation 2.3 allows remote attackers to execute arbitrary SQL commands via the session parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1006-exploits/schoolmation-sqlxss.txt; http://securityreason.com/securityalert/8508; http://www.exploit-db.com/exploits/13812/
CVE: CVE-2010-5012
Published: 2011-11-02
Description: SQL injection vulnerability in new.php in DaLogin 2.2 and 2.2.5 allows remote attackers to execute arbitrary SQL commands via the id parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/65471; http://packetstormsecurity.org/1006-exploits/dalogin-sqlxssdisclose.txt; http://secunia.com/advisories/40204
CVE: CVE-2010-5013
Published: 2011-11-02
Description: SQL injection vulnerability in listing_detail.asp in Mckenzie Creations Virtual Real Estate Manager (VRM) 3.5 allows remote attackers to execute arbitrary SQL commands via the Lid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/65415; http://packetstormsecurity.org/1006-exploits/virtualrealestate-sql.txt; http://secunia.com/advisories/40166
CVE: CVE-2010-5014
Published: 2011-11-02
Description: SQL injection vulnerability in standings.php in Elite Gaming Ladders 3.5 allows remote attackers to execute arbitrary SQL commands via the ladder[id] parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/36732; http://www.exploit-db.com/exploits/13936; http://www.securityfocus.com/bid/40981
CVE: CVE-2010-5015
Published: 2011-11-02
Description: SQL injection vulnerability in view_photo.php in 2daybiz Network Community Script allows remote attackers to execute arbitrary SQL commands via the alb parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/40247; http://securityreason.com/securityalert/8511; http://www.packetstormsecurity.com/1006-exploits/2daybiz-sqlxss.txt
CVE: CVE-2010-5016
Published: 2011-11-02
Description: SQL injection vulnerability in matchdb.php in Elite Gaming Ladders 3.5 and earlier allows remote attackers to execute arbitrary SQL commands via the match parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/36732; http://www.exploit-db.com/exploits/12158; http://www.securityfocus.com/bid/39625
CVE: CVE-2010-5017
Published: 2011-11-02
Description: SQL injection vulnerability in stats.php in Elite Gaming Ladders 3.0 allows remote attackers to execute arbitrary SQL commands via the account parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/36732; http://www.exploit-db.com/exploits/10978; http://www.securityfocus.com/bid/40163
CVE: CVE-2010-5018
Published: 2011-11-02
Description: Cross-site scripting (XSS) vulnerability in products/classified/headersearch.php in 2daybiz Online Classified Script allows remote attackers to inject arbitrary web script or HTML via the sid parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/1006-exploits/2daybizocs-sqlxss.txt; http://secunia.com/advisories/40213; http://www.exploit-db.com/exploits/13894
CVE: CVE-2010-5019
Published: 2011-11-02
Description: SQL injection vulnerability in view_photo.php in 2daybiz Online Classified Script allows remote attackers to execute arbitrary SQL commands via the alb parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1006-exploits/2daybizocs-sqlxss.txt; http://secunia.com/advisories/40213; http://www.exploit-db.com/exploits/13894
CVE: CVE-2010-5020
Published: 2011-11-02
Description: SQL injection vulnerability in index.php in NetArt Media iBoutique 4.0 allows remote attackers to execute arbitrary SQL commands via the page parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/31871; http://www.exploit-db.com/exploits/13945; http://www.securityfocus.com/bid/41014
CVE: CVE-2010-5021
Published: 2011-11-02
Description: SQL injection vulnerability in view_group.asp in Digital Interchange Document Library 5.8.5 allows remote attackers to execute arbitrary SQL commands via the intGroupID parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1006-exploits/digitalinterchangelibrary-sql.txt; http://secunia.com/advisories/40160; http://securityreason.com/securityalert/8512
CVE: CVE-2010-5022
Published: 2011-11-02
Description: SQL injection vulnerability in the JExtensions JE Story Submit (com_jesubmit) component 1.4 for Joomla! allows remote attackers to execute arbitrary SQL commands via the view parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/14054; http://www.securityfocus.com/bid/41171; http://www.exploit-db.com/exploits/14054
CVE: CVE-2010-5023
Published: 2011-11-02
Description: SQL injection vulnerability in index.asp in Digital Interchange Calendar 5.8.5 allows remote attackers to execute arbitrary SQL commands via the intDivisionID parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1006-exploits/digitalinterchange-sql.txt; http://securityreason.com/securityalert/8513; http://www.exploit-db.com/exploits/13860
CVE: CVE-2010-5024
Published: 2011-11-02
Description: SQL injection vulnerability in manage/add_user.php in CuteSITE CMS 1.2.3 and 1.5.0 allows remote authenticated users, with Read privileges, to execute arbitrary SQL commands via the user_id parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-89
References: http://packetstormsecurity.org/1006-exploits/cutesitecms-sql.txt; http://secunia.com/advisories/39864; http://securityreason.com/securityalert/8515
CVE: CVE-2010-5025
Published: 2011-11-02
Description: Cross-site scripting (XSS) vulnerability in manage/main.php in CuteSITE CMS 1.2.3 and 1.5.0 allows remote attackers to inject arbitrary web script or HTML via the fld_path parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/1006-exploits/cutesitecms-xss.txt; http://secunia.com/advisories/39864; http://securityreason.com/securityalert/8514
CVE: CVE-2010-5026
Published: 2011-11-02
Description: SQL injection vulnerability in winners.php in Science Fair In A Box (SFIAB) 2.0.6 and 2.2.0 allows remote attackers to execute arbitrary SQL commands via the type parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://packetstormsecurity.org/1006-exploits/fairinabox-sqlxss.txt; http://secunia.com/advisories/40170; http://securityreason.com/securityalert/8516
CVE: CVE-2010-5027
Published: 2011-11-02
Description: Cross-site scripting (XSS) vulnerability in winners.php in Science Fair In A Box (SFIAB) 2.0.6 and 2.2.0 allows remote attackers to inject arbitrary web script or HTML via the type parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/1006-exploits/fairinabox-sqlxss.txt; http://secunia.com/advisories/40170; http://securityreason.com/securityalert/8516
CVE: CVE-2010-5028
Published: 2011-11-02
Description: SQL injection vulnerability in the JExtensions JE Job (com_jejob) component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter in an item action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/39837; http://www.exploit-db.com/exploits/12782; http://www.osvdb.org/64708
CVE: CVE-2010-5029
Published: 2011-11-02
Description: SQL injection vulnerability in index.php in Ecomat CMS 5.0 allows remote attackers to execute arbitrary SQL commands via the show parameter in a web action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1006-exploits/ecomatcms-sql.txt; http://secunia.com/advisories/40013; http://securityreason.com/securityalert/8518
CVE: CVE-2010-5030
Published: 2011-11-02
Description: Cross-site scripting (XSS) vulnerability in index.php in Ecomat CMS 5.0 allows remote attackers to inject arbitrary web script or HTML via the lang parameter in a web action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/1006-exploits/ecomatcms-xss.txt; http://secunia.com/advisories/40013; http://securityreason.com/securityalert/8517
CVE: CVE-2010-5031
Published: 2011-11-02
Description: Cross-site scripting (XSS) vulnerability in index.php in fileNice 1.1 allows remote attackers to inject arbitrary web script or HTML via the sstring parameter (aka the Search Box).  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/1006-exploits/filenicescript-xss.txt; http://secunia.com/advisories/40077; http://securityreason.com/securityalert/8519
CVE: CVE-2010-5032
Published: 2011-11-02
Description: SQL injection vulnerability in the BF Quiz (com_bfquiztrial) component before 1.3.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter in a bfquiztrial action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/65001; http://packetstormsecurity.org/1005-exploits/joomla_com_bfquiz_sploit.py.txt; http://secunia.com/advisories/39960
CVE: CVE-2010-5033
Published: 2011-11-02
Description: SQL injection vulnerability in ProductList.cfm in Fusebox 5.5.1 allows remote attackers to execute arbitrary SQL commands via the CatDisplay parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1005-exploits/fusebox-sql.txt; http://securityreason.com/securityalert/8520; http://www.exploit-db.com/exploits/12786
CVE: CVE-2010-5034
Published: 2011-11-02
Description: SQL injection vulnerability in viewhistorydetail.php in iScripts EasyBiller 1.1 allows remote attackers to execute arbitrary SQL commands via the planid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1006-exploits/iscriptseasybiller-sql.txt; http://secunia.com/advisories/40088; http://securityreason.com/securityalert/8521
CVE: CVE-2010-5035
Published: 2011-11-02
Description: Cross-site scripting (XSS) vulnerability in search.php in iScripts eSwap 2.0 allows remote attackers to inject arbitrary web script or HTML via the txtHomeSearch parameter (aka the search field).  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/1006-exploits/iscriptsewap-sqlxss.txt; http://secunia.com/advisories/40087; http://securityreason.com/securityalert/8522
CVE: CVE-2010-5036
Published: 2011-11-02
Description: SQL injection vulnerability in addsale.php in iScripts eSwap 2.0 allows remote attackers to execute arbitrary SQL commands via the type parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1006-exploits/iscriptsewap-sqlxss.txt; http://securityreason.com/securityalert/8522; http://www.exploit-db.com/exploits/13740/
CVE: CVE-2010-5037
Published: 2011-11-02
Description: SQL injection vulnerability in article.php in SenseSites CommonSense CMS allows remote attackers to execute arbitrary SQL commands via the article_id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1006-exploits/commonsensecms-sql.txt; http://securityreason.com/securityalert/8526; http://www.exploit-db.com/exploits/13762/
CVE: CVE-2010-5038
Published: 2011-11-02
Description: PHP remote file inclusion vulnerability in contact/contact.php in Groone's Simple Contact Form allows remote attackers to execute arbitrary PHP code via a URL in the abspath parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://packetstormsecurity.org/1005-exploits/groonescf-rfi.txt; http://securityreason.com/securityalert/8523; http://www.securityfocus.com/archive/1/511551/100/0/threaded
CVE: CVE-2010-5039
Published: 2011-11-02
Description: SQL injection vulnerability in control/admin_login.php in ScriptsFeed Recipes Listing Portal 1.0 allows remote attackers to execute arbitrary SQL commands via the loginid parameter (aka the UserName field).  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/39929; http://www.exploit-db.com/exploits/12703/; http://www.osvdb.org/64841