deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-1842
Published: 2008-04-16
Description: Integer signedness error in ovspmd.exe in HP OpenView Network Node Manager (OV NNM) 8.01, and 7.53 and earlier, allows remote attackers to cause a denial of service (daemon crash) or execute arbitrary code via a long request to TCP port 8886 that begins with a certain negative integer, which passes a signed comparison and triggers a heap-based buffer overflow.
CVSS Score: 10.0 (HIGH)
CWE: CWE-189
References: http://aluigi.altervista.org/adv/closedview-adv.txt; http://aluigi.org/poc/closedview.zip; http://marc.info/?l=bugtraq&m=[PII_REDACTED]5849&w=2
CVE: CVE-2008-1843
Published: 2008-04-16
Description: SQL injection vulnerability in browse.php in W2B DatingClub (aka Dating Club) allows remote attackers to execute arbitrary SQL commands via the age_to parameter in a browsebyCat action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://forum.aria-security.com/showthread.php?p=70; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1586&w=2; http://secunia.com/advisories/29815
CVE: CVE-2008-1844
Published: 2008-04-16
Description: SQL injection vulnerability in cat.php in W2B phpHotResources allows remote attackers to execute arbitrary SQL commands via the kind parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://forum.aria-security.com/showthread.php?p=70; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1586&w=2; http://secunia.com/advisories/29825
CVE: CVE-2008-1845
Published: 2008-04-16
Description: The Korn shell (aka mksh) before R33d on MirOS (aka MirBSD) does not flush the tty's I/O when invoking mksh in a new terminal, which allows local users to gain privileges by opening a virtual terminal and entering command sequences, which might later be executed in opportunistic circumstances by a different user who launches mksh and specifies that terminal with the -T option.
CVSS Score: 7.2 (HIGH)
References: http://secunia.com/advisories/29803; http://www.mirbsd.org/mksh.htm#clog; http://www.osvdb.org/44365
CVE: CVE-2008-1846
Published: 2008-04-16
Description: The default configuration of SAP NetWeaver before 7.0 SP15 does not enable the "Always Use Secure HTML Editor" (aka Editor Security or Secure Editing) parameter, which allows remote attackers to conduct cross-site scripting (XSS) attacks by entering feedback for a file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://securityreason.com/securityalert/3812; http://www.aitsec.com/vulnerability-SAP-Netweaver-6.40-7.0-Cross-Site-Scripting.php; http://www.securityfocus.com/archive/1/490625/100/0/threaded
CVE: CVE-2008-1847
Published: 2008-04-16
Description: SQL injection vulnerability in view.php in CoronaMatrix phpAddressBook 2.11 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/28750; https://exchange.xforce.ibmcloud.com/vulnerabilities/41498; https://www.exploit-db.com/exploits/5432
CVE: CVE-2008-1848
Published: 2008-04-16
Description: Cross-site scripting (XSS) vulnerability in the joomlaXplorer (com_joomlaxplorer) Mambo/Joomla! component 1.6.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the error parameter in a show_error action to index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/28746; https://exchange.xforce.ibmcloud.com/vulnerabilities/41779; https://www.exploit-db.com/exploits/5431
CVE: CVE-2008-1849
Published: 2008-04-16
Description: Directory traversal vulnerability in index.php in the joomlaXplorer (com_joomlaxplorer) Mambo/Joomla! component 1.6.2 and earlier allows remote attackers to list arbitrary directories via a .. (dot dot) in the dir parameter in a show_error action.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://www.securityfocus.com/bid/28746; https://exchange.xforce.ibmcloud.com/vulnerabilities/41778; https://www.exploit-db.com/exploits/5431
CVE: CVE-2008-1850
Published: 2008-04-16
Description: Multiple cross-site scripting (XSS) vulnerabilities in login.php in Omnistar Interactive OSI Affiliate allow remote attackers to inject arbitrary web script or HTML via the (1) login, (2) profile, (3) profile2, and (4) ref parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/29779; http://www.mrzayas.es/2008/04/11/xss-en-osiaffiliate/; http://www.osvdb.org/44376
CVE: CVE-2007-5664
Published: 2008-04-16
Description: db2dasrrm in the DB2 Administration Server (DAS) in IBM DB2 Universal Database 9.5 before Fix Pack 1, 9.1 before Fix Pack 4a, and 8 before FixPak 16 allows local users to overwrite arbitrary files via a symlink attack on files used for initialization.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-59
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=688; http://secunia.com/advisories/29784; http://www.securityfocus.com/bid/27870
CVE: CVE-2007-5758
Published: 2008-04-16
Description: Stack-based buffer overflow in db2dasrrm in the DB2 Administration Server (DAS) in IBM DB2 Universal Database 9.5 before Fix Pack 1, 9.1 before Fix Pack 4a, and 8 before FixPak 16 allows local users to execute arbitrary code via a long DASPROF environment variable.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-119
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=689; http://secunia.com/advisories/29784; http://www.securityfocus.com/bid/27870
CVE: CVE-2008-0068
Published: 2008-04-16
Description: Directory traversal vulnerability in OpenView5.exe in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote attackers to read arbitrary files via directory traversal sequences in the Action parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://aluigi.altervista.org/adv/closedviewx-adv.txt; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1253&w=2; http://secunia.com/advisories/29796
CVE: CVE-2008-0892
Published: 2008-04-16
Description: The replication monitor CGI script (repl-monitor-cgi.pl) in Red Hat Administration Server, as used by Red Hat Directory Server 8.0 EL4 and EL5, allows remote attackers to execute arbitrary commands.
CVSS Score: 9.0 (HIGH)
CWE: CWE-20
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01433676; http://secunia.com/advisories/29761; http://secunia.com/advisories/29826
CVE: CVE-2008-0893
Published: 2008-04-16
Description: Red Hat Administration Server, as used by Red Hat Directory Server 8.0 EL4 and EL5, does not properly restrict access to CGI scripts, which allows remote attackers to perform administrative actions.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/29761; http://secunia.com/advisories/29826; http://www.redhat.com/support/errata/RHSA-2008-0201.html
CVE: CVE-2008-1851
Published: 2008-04-16
Description: ovalarmsrv in HP OpenView Network Node Manager (OV NNM) 7.51, 7.53, and possibly other versions allows remote attackers to cause a denial of service (hang) via certain requests that do not provide all required arguments.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://aluigi.altervista.org/adv/closedviewx-adv.txt; http://secunia.com/advisories/29796; http://www.securityfocus.com/archive/1/490771
CVE: CVE-2008-1852
Published: 2008-04-16
Description: ovalarmsrv in HP OpenView Network Node Manager (OV NNM) 7.51, 7.53, and possibly other versions allows remote attackers to cause a denial of service (crash) via certain requests that specify a large number of sub-arguments, which triggers a NULL pointer dereference due to memory allocation failure.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://aluigi.altervista.org/adv/closedviewx-adv.txt; http://secunia.com/advisories/29796; http://www.securityfocus.com/archive/1/490771
CVE: CVE-2008-1853
Published: 2008-04-16
Description: The ovtopmd service in HP OpenView Network Node Manager (OV NNM) 7.51, 7.53, and possibly other versions allows remote attackers to cause a denial of service (exit) by sending a 0x36 packet (exit request).
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-399
References: http://aluigi.altervista.org/adv/closedviewx-adv.txt; http://secunia.com/advisories/29796; http://www.securityfocus.com/archive/1/490771
CVE: CVE-2008-1854
Published: 2008-04-16
Description: Unspecified vulnerability in SmarterMail Web Server (SMWebSvr.exe) in SmarterMail 5.0.2999 allows remote attackers to cause a denial of service (service termination) via a long HTTP (1) GET, (2) HEAD, (3) PUT, (4) POST, or (5) TRACE request.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/29732; http://www.securityfocus.com/bid/28610; https://exchange.xforce.ibmcloud.com/vulnerabilities/41710
CVE: CVE-2008-1855
Published: 2008-04-16
Description: FrameworkService.exe in McAfee Common Management Agent (CMA) 3.6.0.574 Patch 3 and earlier, as used by ePolicy Orchestrator (ePO) and ProtectionPilot (PrP), allows remote attackers to corrupt memory and cause a denial of service (CMA Framework service crash) via a long invalid method in requests for the /spin//AVClient//AVClient.csp URI, a different vulnerability than CVE-2006-5274.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://secunia.com/advisories/29637; http://www.offensive-security.com/0day/mcafee_again.py.txt; http://www.securityfocus.com/bid/28573
CVE: CVE-2008-1856
Published: 2008-04-16
Description: plugins/maps/db_handler.php in LinPHA 1.3.3 and earlier does not require authentication for a settings action that modifies the configuration file, which allows remote attackers to conduct directory traversal attacks and execute arbitrary local files by placing directory traversal sequences into the maps_type configuration setting, and then sending a request to maps_view.php, which causes plugins/maps/map.main.class.php to use the modified configuration.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-20, CWE-22
References: http://secunia.com/advisories/29724; http://sourceforge.net/project/shownotes.php?release_id=595725; http://www.osvdb.org/50229
CVE: CVE-2008-1857
Published: 2008-04-16
Description: Multiple directory traversal vulnerabilities in viewsource.php in Make our Life Easy (Mole) 2.1.0 allow remote attackers to read arbitrary files via directory traversal sequences in the (1) dirn and (2) fname parameters.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/29685; http://www.securityfocus.com/bid/28659; http://www.vupen.com/english/advisories/2008/1141/references
CVE: CVE-2008-1858
Published: 2008-04-16
Description: SQL injection vulnerability in index.php in 724Networks 724CMS 4.01 and earlier allows remote attackers to execute arbitrary SQL commands via the ID parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/28672; http://www.vupen.com/english/advisories/2008/1139/references; https://exchange.xforce.ibmcloud.com/vulnerabilities/41700
CVE: CVE-2008-1859
Published: 2008-04-16
Description: SQL injection vulnerability in events.php in iScripts SocialWare allows remote attackers to execute arbitrary SQL commands via the id parameter in a show action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/29725; http://www.securityfocus.com/bid/28669; http://www.vupen.com/english/advisories/2008/1137/references
CVE: CVE-2007-6713
Published: 2008-04-16
Description: Unspecified vulnerability in Flip4Mac WMV before 2.2.0.49 has unknown impact and attack vectors related to malformed WMV files.
CVSS Score: 9.3 (HIGH)
References: http://secunia.com/advisories/29922; http://www.flip4mac.com/downloads/wmv_components/rel_Flip4mac_WMV_2.2.0.49.pdf; http://www.securityfocus.com/bid/28912
CVE: CVE-2007-5745
Published: 2008-04-17
Description: Multiple heap-based buffer overflows in OpenOffice.org before 2.4 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a Quattro Pro (QPRO) file with crafted (1) Attribute and (2) Font Description records.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=691; http://secunia.com/advisories/29852; http://secunia.com/advisories/29864
CVE: CVE-2007-5746
Published: 2008-04-17
Description: Integer overflow in OpenOffice.org before 2.4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an EMF file with a crafted EMR_STRETCHBLT record, which triggers a heap-based buffer overflow.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-189
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=692; http://secunia.com/advisories/29844; http://secunia.com/advisories/29852
CVE: CVE-2007-5747
Published: 2008-04-17
Description: Integer underflow in OpenOffice.org before 2.4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a Quattro Pro (QPRO) file with crafted values that trigger an excessive loop and a stack-based buffer overflow.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-189
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=693; http://secunia.com/advisories/29852; http://secunia.com/advisories/29864
CVE: CVE-2008-0320
Published: 2008-04-17
Description: Heap-based buffer overflow in the OLE importer in OpenOffice.org before 2.4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an OLE file with a crafted DocumentSummaryInformation stream.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=694; http://secunia.com/advisories/29844; http://secunia.com/advisories/29852
CVE: CVE-2008-1024
Published: 2008-04-17
Description: Apple Safari before 3.1.1, when running on Windows XP or Vista, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a file download with a crafted file name, which triggers memory corruption.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce/2008/Apr/msg00001.html; http://support.apple.com/kb/HT1467; http://www.kb.cert.org/vuls/id/529441
CVE: CVE-2008-1025
Published: 2008-04-17
Description: Cross-site scripting (XSS) vulnerability in Apple WebKit, as used in Safari before 3.1.1, allows remote attackers to inject arbitrary web script or HTML via a crafted URL with a colon in the hostname portion.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.apple.com/archives/security-announce/2008//Jul/msg00001.html; http://lists.apple.com/archives/security-announce/2008/Apr/msg00001.html; http://secunia.com/advisories/29846
CVE: CVE-2008-1026
Published: 2008-04-17
Description: Integer overflow in the PCRE regular expression compiler (JavaScriptCore/pcre/pcre_compile.cpp) in Apple WebKit, as used in Safari before 3.1.1, allows remote attackers to execute arbitrary code via a regular expression with large, nested repetition counts, which triggers a heap-based buffer overflow.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2008//Jul/msg00001.html; http://lists.apple.com/archives/security-announce/2008/Apr/msg00001.html; http://secunia.com/advisories/29846
CVE: CVE-2008-1380
Published: 2008-04-17
Description: The JavaScript engine in Mozilla Firefox before 2.0.0.14, Thunderbird before 2.0.0.14, and SeaMonkey before 1.1.10 allows remote attackers to cause a denial of service (garbage collector crash) and possibly have other impacts via a crafted web page.  NOTE: this is due to an incorrect fix for CVE-2008-1237.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-security-announce/2008-05/msg00000.html; http://secunia.com/advisories/29787; http://secunia.com/advisories/29793
CVE: CVE-2008-1860
Published: 2008-04-17
Description: Static code injection vulnerability in admin.php in LokiCMS 0.3.3 and earlier allows remote attackers to inject arbitrary PHP code into includes/Config.php via the default parameter.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/29749; http://www.securityfocus.com/archive/1/492877/100/0/threaded; http://www.vupen.com/english/advisories/2008/1162/references
CVE: CVE-2008-1861
Published: 2008-04-17
Description: Directory traversal vulnerability in modules/threadstop/threadstop.php in ExBB Italia 0.22 and earlier, when register_globals is enabled and magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the exbb[default_lang] parameter.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/29739; http://www.securityfocus.com/bid/28686; https://exchange.xforce.ibmcloud.com/vulnerabilities/41707
CVE: CVE-2008-1862
Published: 2008-04-17
Description: ExBB Italia 0.22 and earlier only checks GET requests that use the QUERY_STRING for certain path manipulations, which allows remote attackers to bypass this check via (1) POST or (2) COOKIE variables, a different vector than CVE-2006-4488.  NOTE: this can be leveraged to conduct PHP remote file inclusion attacks via a URL in the (a) new_exbb[home_path] or (b) exbb[home_path] parameter to modules/threadstop/threadstop.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20, CWE-94
References: http://secunia.com/advisories/29739; https://exchange.xforce.ibmcloud.com/vulnerabilities/41708; https://www.exploit-db.com/exploits/5405
CVE: CVE-2008-1863
Published: 2008-04-17
Description: SQL injection vulnerability in view_reviews.php in Prozilla Cheat Script (aka Cheats) 2.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/29701; http://www.securityfocus.com/bid/28640; http://www.vupen.com/english/advisories/2008/1116/references
CVE: CVE-2008-1864
Published: 2008-04-17
Description: SQL injection vulnerability in project.php in Prozilla Freelancers allows remote attackers to execute arbitrary SQL commands via the project parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/29723; http://www.securityfocus.com/bid/28653; https://exchange.xforce.ibmcloud.com/vulnerabilities/41705
CVE: CVE-2008-1865
Published: 2008-04-17
Description: Stack-based buffer overflow in the msx_readnode function in libmosix.c in openmosix-tools (aka userspace-tools) in openMosix might allow local users to cause a denial of service (application crash) via a third-party program that calls this function with a long item argument.  NOTE: the vendor does not provide any program that is capable of causing this overflow.
CVSS Score: 1.9 (LOW)
CWE: CWE-119
References: http://securityreason.com/securityalert/3813; http://www.securityfocus.com/archive/1/490534/100/0/threaded; http://www.securityfocus.com/bid/28663
CVE: CVE-2008-1866
Published: 2008-04-17
Description: admin/modif_config.php in Blog Pixel Motion (aka PixelMotion) does not require admin authentication, which allows remote authenticated users to upload arbitrary PHP scripts in a ZIP archive, which is written to templateZip/ and then automatically extracted under templates/ for execution via a direct request.
CVSS Score: 9.0 (HIGH)
CWE: CWE-94
References: http://www.securityfocus.com/bid/28646; http://www.vupen.com/english/advisories/2008/1121/references; https://exchange.xforce.ibmcloud.com/vulnerabilities/41670
CVE: CVE-2008-1867
Published: 2008-04-17
Description: SQL injection vulnerability in Blog Pixel Motion (aka Blog PixelMotion) allows remote attackers to execute arbitrary SQL commands via the categorie parameter to index.php, possibly related to include/requetesIndex.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/28645; http://www.vupen.com/english/advisories/2008/1121/references; https://exchange.xforce.ibmcloud.com/vulnerabilities/41668
CVE: CVE-2008-1868
Published: 2008-04-17
Description: admin/sauvBase.php in Blog Pixel Motion (aka Blog PixelMotion) does not require authentication, which allows remote attackers to trigger a database backup dump, and obtain the resulting blogPM.sql file that contains sensitive information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://www.vupen.com/english/advisories/2008/1121/references; https://exchange.xforce.ibmcloud.com/vulnerabilities/41671; https://www.exploit-db.com/exploits/5380
CVE: CVE-2008-1869
Published: 2008-04-17
Description: SQL injection vulnerability in Site Sift Listings allows remote attackers to execute arbitrary SQL commands via the id parameter in a detail action to index.php.  NOTE: this issue might be site-specific.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/29705; http://www.securityfocus.com/bid/28644; http://www.vupen.com/english/advisories/2008/1120/references
CVE: CVE-2008-1870
Published: 2008-04-17
Description: SQL injection vulnerability in getdata.php in PIGMy-SQL 1.4.1 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/29703; http://www.securityfocus.com/bid/28634; http://www.vupen.com/english/advisories/2008/1135/references
CVE: CVE-2008-1871
Published: 2008-04-17
Description: SQL injection vulnerability in links.php in Scriptsagent.com Links Directory 1.1 allows remote authenticated users to execute arbitrary SQL commands via the cat_id parameter in a list action.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/29710; http://www.securityfocus.com/bid/28655; http://www.vupen.com/english/advisories/2008/1126/references
CVE: CVE-2008-1872
Published: 2008-04-17
Description: SQL injection vulnerability in home.news.php in Comdev News Publisher 4.1.2 allows remote attackers to execute arbitrary SQL commands via the arcmonth parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/29697; http://www.securityfocus.com/bid/28622; https://exchange.xforce.ibmcloud.com/vulnerabilities/41663
CVE: CVE-2008-1873
Published: 2008-04-17
Description: Cross-site scripting (XSS) vulnerability in the private message feature in Nuke ET 3.2 and 3.4, when using Internet Explorer, allows remote authenticated users to inject arbitrary web script or HTML via a CSS property in the STYLE attribute of a DIV element in the mensaje parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://mrzayas.es/wp-content/poc/nukeet.txt; http://secunia.com/advisories/29651; http://www.mrzayas.es/2008/04/04/xploitnukeet3/
CVE: CVE-2008-1874
Published: 2008-04-17
Description: SQL injection vulnerability in account/user/mail.html in Xpoze Pro 3.05 and earlier allows remote authenticated users to execute arbitrary SQL commands via the reed parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/29700; http://www.securityfocus.com/bid/28618; https://exchange.xforce.ibmcloud.com/vulnerabilities/41656
CVE: CVE-2008-1875
Published: 2008-04-17
Description: SQL injection vulnerability in index.php in Terong PHP Photo Gallery (aka Advanced Web Photo Gallery) 1.0 allows remote attackers to execute arbitrary SQL commands via the photo_id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/29667; http://www.securityfocus.com/bid/28626; https://exchange.xforce.ibmcloud.com/vulnerabilities/41665
CVE: CVE-2008-1876
Published: 2008-04-17
Description: PHP remote file inclusion vulnerability in index.php in VisualPic 0.3.1 allows remote attackers to execute arbitrary PHP code via a URL in the _CONFIG[files][functions_page] parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://www.vupen.com/english/advisories/2008/1127/references; https://exchange.xforce.ibmcloud.com/vulnerabilities/41667; https://www.exploit-db.com/exploits/5375