rainbutterfly/cve_corpus huggingface dataset:
CVE-2007-6496 
Hosting Controller 6.1 Hot fix 3.3 and earlier allows remote attackers to register arbitrary users via a request to hosting/addsubsite.asp with the loginname and password parameters set, when preceded by certain requests to hosting/default.asp and hosting/selectdomain.asp, a related issue to CVE-2005-1654.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-20T20:00:00.000Z
CVE-2007-6497 
Hosting Controller 6.1 Hot fix 3.3 and earlier (1) allows remote attackers to change arbitrary user profiles via a request to Hosting/Addreseller.asp with modified loginname and email parameters; and (2) allows remote authenticated users to change a credit amount and increase a discount via an UpdateUser action to Accounts/AccountActions.asp with modified UserName, FullName, CreditLimit, and DefaultDiscount parameters, a related issue to CVE-2005-2219.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-20T20:00:00.000Z
CVE-2007-6498 
Multiple SQL injection vulnerabilities in Hosting Controller 6.1 Hot fix 3.3 and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) email and (2) loginname parameters to Hosting/Addreseller.asp, (3) the sortfield parameter to accounts/accountmanager.asp, (4) the GateWayID parameter to OpenApi/GatewayVariables.asp, and possibly (5) unspecified vectors to IIS/iibind.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-20T20:00:00.000Z
CVE-2007-6499 
Unspecified vulnerability in Hosting Controller 6.1 Hot fix 3.3 and earlier allows remote authenticated users to uninstall the FrontPage extensions of an arbitrary account via a request to fp2002/UNINSTAL.asp with a "host id (IIS) value."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-20T20:00:00.000Z
CVE-2007-6500 
Unspecified vulnerability in Hosting Controller 6.1 Hot fix 3.3 and earlier allows remote authenticated users to delete "gateway information" via a request to OpenApi/GatewayVariables.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-20T20:00:00.000Z
CVE-2007-6501 
Unspecified vulnerability in Hosting Controller 6.1 Hot fix 3.3 and earlier allows remote authenticated users to enable or disable "pay type" via a request to adminsettings/choosetranstype.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-20T20:00:00.000Z
CVE-2007-6502 
Hosting Controller 6.1 Hot fix 3.3 and earlier allows remote authenticated users to obtain sensitive information via (1) the AdminName and AdminLevel parameters to fp2000/NEWSRVR.asp, which discloses usernames; and (2) certain XML HTTP requests to hosting/css.asp using Microsoft.XMLHTTP or MSXML2.XMLHTTP objects, which trigger a response with the setup directory pathname in the HTML source; and (3) might allow remote attackers to obtain sensitive information via a request for /admin/forum/, which reveals the path in an error message when a forum is not found.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-20T20:00:00.000Z
CVE-2007-6503 
Multiple unspecified vulnerabilities in Hosting Controller 6.1 Hot fix 3.3 and earlier allow remote authenticated users to (1) import an arbitrary plan via a request to hosting/importhostingplans.asp; or (2) change an arbitrary plan via a request to hosting/AutoSignUpPlans.asp with the (a) save, (b) 30, and (c) d_30 parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-20T20:00:00.000Z
CVE-2007-6504 
Unspecified vulnerability in IIS/iibind.asp in Hosting Controller 6.1 Hot fix 3.3 and earlier allows remote authenticated users to change the headers of arbitrary hosts via an unspecified parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-20T20:00:00.000Z
CVE-2007-6505 
Solaris 9, with Solaris Auditing enabled and certain patches for sshd installed, can generate audit records with an audit-ID of 0 even when the user logging into ssh is not root, which makes it easier for attackers to avoid detection and can make it more difficult to conduct forensics activities.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-20T23:00:00.000Z
CVE-2007-6506 
The HPRulesEngine.ContentCollection.1 ActiveX Control in RulesEngine.dll for HP Software Update 4.000.005.007 and earlier, including 3.0.8.4, allows remote attackers to (1) overwrite and corrupt arbitrary files via arguments to the SaveToFile method, and possibly (2) access arbitrary files via the LoadDataFromFile method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-20T23:00:00.000Z
CVE-2007-6507 
SpntSvc.exe daemon in Trend Micro ServerProtect 5.58 for Windows, before Security Patch 4, exposes unspecified dangerous sub-functions from StRpcSrv.dll in the DCE/RPC interface, which allows remote attackers to obtain "full file system access" and execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-20T23:00:00.000Z
CVE-2007-6508 
Directory traversal vulnerability in view.php in xeCMS 1.0 allows remote attackers to read arbitrary files via a ..%2F (dot dot slash) in the list parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-21T19:00:00.000Z
CVE-2007-6509 
Unspecified vulnerability in Appian Enterprise Business Process Management (BPM) Suite 5.6 SP1 allows remote attackers to cause a denial of service via a crafted packet to port 5400/tcp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-21T19:00:00.000Z
CVE-2007-6510 
Multiple stack-based buffer overflows in ProWizard 4 PC (prowiz) 1.62 and earlier allow remote attackers to execute arbitrary code via a crafted file to the (1) AMOS-MusicBank, (2) FuzzacPacker, and (3) QuadraComposer rippers; and (4) have an unknown impact via a crafted file to the SkytPacker ripper.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-21T19:00:00.000Z
CVE-2007-6511 
Websense Enterprise 6.3.1 allows remote attackers to bypass content filtering by visiting http URLs with a (1) RealPlayer G2, (2) MSMSGS, or (3) StoneHttpAgent User-Agent header, which results in a Non-HTTP categorization.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-21T19:00:00.000Z
CVE-2007-6512 
PHP MySQL Banner Exchange 2.2.1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain database information via a direct request to inc/lib.inc.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-21T22:00:00.000Z
CVE-2007-6513 
HP eSupportDiagnostics ActiveX control (hpediag.dll) 1.0.11.0 exports dangerous methods, which allows remote attackers to (1) read arbitrary files via the ReadTextFile method, or (2) read arbitrary registry values via the ReadValue method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-21T22:00:00.000Z
CVE-2007-6514 
Apache HTTP Server, when running on Linux with a document root on a Windows share mounted using smbfs, allows remote attackers to obtain unprocessed content such as source files for .php programs via a trailing "\" (backslash), which is not handled by the intended AddType directive.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-21T22:00:00.000Z
CVE-2007-6515 
support/dispatch.cgi in SiteScape Forum allows remote attackers to execute arbitrary TCL code via code separator characters in the query string.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-21T22:00:00.000Z
CVE-2007-6516 
Buffer overflow in RavWare Software MAS Flic ActiveX Control (masflc.ocx) 1.0.0.1 allows remote attackers to execute arbitrary code via a long FileName property.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-21T22:00:00.000Z
CVE-2007-6517 
SQL injection vulnerability in the forget password section (LostPwd.asp) in Eagle Software Aeries Browser Interface (ABI) 3.7.9.17 allows remote attackers to execute arbitrary SQL commands via the EmailAddress parameter.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-24T20:00:00.000Z
CVE-2007-6518 
Multiple SQL injection vulnerabilities in search.php in WoltLab Burning Board (wBB) Lite 1.0.2 pl3e allow remote attackers to execute arbitrary SQL commands via the (1) showposts, (2) sortby, and (3) sortorder parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-24T20:00:00.000Z
CVE-2007-6519 
Unspecified vulnerability in the File-on-File Mounting File System (FFM) in HP Tru64 UNIX 5.1B-4 and 5.1B-3 allows local users to cause a denial of service (system crash) via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-24T20:00:00.000Z
CVE-2007-6520 
Opera before 9.25 allows remote attackers to conduct cross-domain scripting attacks via unknown vectors related to plug-ins.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-24T20:00:00.000Z
CVE-2007-6521 
Unspecified vulnerability in Opera before 9.25 allows remote attackers to execute arbitrary code via crafted TLS certificates.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-24T20:00:00.000Z
CVE-2007-6522 
The rich text editing functionality in Opera before 9.25 allows remote attackers to conduct cross-domain scripting attacks by using designMode to modify contents of pages in other domains.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-24T20:00:00.000Z
CVE-2007-6523 
Algorithmic complexity vulnerability in Opera 9.50 beta and 9.x before 9.25 allows remote attackers to cause a denial of service (CPU consumption) via a crafted bitmap (BMP) file that triggers a large number of calculations and checks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-24T20:00:00.000Z
CVE-2007-6524 
Opera before 9.25 allows remote attackers to obtain potentially sensitive memory contents via a crafted bitmap (BMP) file, as demonstrated using a CANVAS element and JavaScript in an HTML document for copying these contents from 9.50 beta, a related issue to CVE-2008-0420.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-24T20:00:00.000Z
CVE-2007-6525 
Unspecified vulnerability in eClient in IBM DB2 Content Manager (CM) Toolkit 8.3 before fix pack 7 for z/OS has unknown impact and attack vectors, related to "scripting."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-27T22:00:00.000Z
CVE-2007-6526 
Cross-site scripting (XSS) vulnerability in tiki-special_chars.php in TikiWiki before 1.9.9 allows remote attackers to inject arbitrary web script or HTML via the area_name parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-27T22:00:00.000Z
CVE-2007-6527 
uploadimg.php in the Automatic Image Upload with Thumbnails (imgUpload) module 1.3.2 for PunBB only verifies the Content-type field of uploaded files, which allows remote attackers to upload and execute arbitrary content via a file with a (1) JPG, (2) GIF, or (3) PNG MIME type.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-27T22:00:00.000Z
CVE-2007-6528 
Directory traversal vulnerability in tiki-listmovies.php in TikiWiki before 1.9.9 allows remote attackers to read arbitrary files via a .. (dot dot) and modified filename in the movie parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-27T22:00:00.000Z
CVE-2007-6529 
Multiple unspecified vulnerabilities in TikiWiki before 1.9.9 have unknown impact and attack vectors involving (1) tiki-edit_css.php, (2) tiki-list_games.php, or (3) tiki-g-admin_shared_source.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-27T22:00:00.000Z
CVE-2007-6530 
Buffer overflow in the XUpload.ocx ActiveX control in Persits Software XUpload 2.1.0.1, and probably other versions before 3.0, as used by HP Mercury LoadRunner and Groove Virtual Office, allows remote attackers to execute arbitrary code via a long argument to the AddFolder function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-27T22:00:00.000Z
CVE-2007-6531 
Stack-based buffer overflow in the Panel (xfce4-panel) component in Xfce before 4.4.2 might allow remote attackers to execute arbitrary code via Launcher tooltips.  NOTE: a second buffer overflow (over-read) in the xfce_mkdirhier function was also reported, but it might not be exploitable for a crash or code execution, so it is not a vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-09T23:00:00.000Z
CVE-2007-6532 
Double free vulnerability in the Widget Library (libxfcegui4) in Xfce before 4.4.2 might allow remote attackers to execute arbitrary code via unknown vectors related to the "cliend id, program name and working directory in session management."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-01-09T23:00:00.000Z
CVE-2007-6533 
Buffer overflow in Zoom Player 6.00 beta 2 and earlier allows user-assisted remote attackers to execute arbitrary code via an HTTP link to a PLS file in a crafted ZPL file, which causes an overflow in Unicode handling when generating an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-27T23:00:00.000Z
CVE-2007-6534 
Multiple unspecified vulnerabilities in Microsoft Office Publisher allow user-assisted remote attackers to cause a denial of service (application crash) via a crafted PUB file, possibly involving wordart.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-27T23:00:00.000Z
CVE-2007-6535 
Buffer overflow in the YShortcut ActiveX control in YShortcut.dll 2006.8.15.1 in Yahoo! Toolbar might allow attackers to execute arbitrary code via a long string to the IsTaggedBM method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-27T23:00:00.000Z
CVE-2007-6536 
The Custom Button Installer dialog in Google Toolbar 4 and 5 beta presents certain domain names in the (1) "Downloaded from" and (2) "Privacy considerations" sections without verifying domain names, which makes it easier for remote attackers to spoof domain names and trick users into installing malicious button XML files, as demonstrated by presenting www.google.com when the button was downloaded from an arbitrary site through an open redirector on www.google.com.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-27T23:00:00.000Z
CVE-2007-6537 
Stack-based buffer overflow in the zfile_gunzip function in zfile.c in WinUAE 1.4.4 and earlier allows user-assisted remote attackers to execute arbitrary code via a long filename in a gzipped archive, such as a (1) gz, (2) adz, (3) roz, or (4) hdz archive in a compressed floppy disk image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-27T23:00:00.000Z
CVE-2007-6538 
SQL injection vulnerability in ing/blocks/mrbs/code/web/view_entry.php in the MRBS plugin for Moodle allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-27T23:00:00.000Z
CVE-2007-6539 
PHP local file inclusion vulnerability in index.php in IDevspot iSupport 1.8 allows remote attackers to include local files via the include_file parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-27T23:00:00.000Z
CVE-2007-6540 
SQL injection vulnerability in neuron news 1.0 allows remote attackers to execute arbitrary SQL commands via the q parameter to the default URI in patch/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-27T23:00:00.000Z
CVE-2007-6541 
Multiple cross-site scripting (XSS) vulnerabilities in neuron news 1.0 allow remote attackers to inject arbitrary web script or HTML via (1) the topic parameter in a viewtopic action, or the (2) newsyear or (3) newsmonth parameter in a newsarchive action to the default URI in patch/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-27T23:00:00.000Z
CVE-2007-6542 
PHP remote file inclusion vulnerability in admin/frontpage_right.php in Arcadem LE 2.04 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the loadadminpage parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-27T23:00:00.000Z
CVE-2007-6543 
SQL injection vulnerability in suggest-link.php in eSyndiCat Link Exchange Script allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-28T00:00:00.000Z
CVE-2007-6544 
Multiple SQL injection vulnerabilities in RunCMS before 1.6.1 allow remote attackers to execute arbitrary SQL commands via the lid parameter to (1) brokenfile.php, (2) visit.php, or (3) ratefile.php in modules/mydownloads/; or (4) ratelink.php, (5) modlink.php, or (6) brokenlink.php in modules/mylinks/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-28T00:00:00.000Z
CVE-2007-6545 
Multiple cross-site scripting (XSS) vulnerabilities in RunCMS before 1.6.1 allow remote attackers to inject arbitrary web script or HTML via (1) the subject parameter to modules/news/submit.php; (2) the PATH_INFO to modules/news/index.php, possibly related to the XoopsPageNav class; or (3) an avatar image to edituser.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-28T00:00:00.000Z
CVE-2007-6546 
RunCMS before 1.6.1 uses a predictable session id, which makes it easier for remote attackers to hijack sessions via a modified id.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-28T00:00:00.000Z
CVE-2007-6547 
RunCMS before 1.6.1 does not require entry of the old password during a password change, which allows context-dependent attackers to change passwords upon obtaining temporary access to a session.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-28T00:00:00.000Z
CVE-2007-6548 
Multiple direct static code injection vulnerabilities in RunCMS before 1.6.1 allow remote authenticated administrators to inject arbitrary PHP code via the (1) header and (2) footer parameters to modules/system/admin.php in a meta-generator action, (3) the disclaimer parameter to modules/system/admin.php in a disclaimer action, (4) the disclaimer parameter to modules/mydownloads/admin/index.php in a mydownloadsConfigAdmin action, (5) the disclaimer parameter to modules/newbb_plus/admin/forum_config.php, (6) the disclaimer parameter to modules/mylinks/admin/index.php in a myLinksConfigAdmin action, or (7) the intro parameter to modules/sections/admin/index.php in a secconfig action, which inject PHP sequences into (a) sections/cache/intro.php, (b) mylinks/cache/disclaimer.php, (c) mydownloads/cache/disclaimer.php, (d) newbb_plus/cache/disclaimer.php, (e) system/cache/disclaimer.php, (f) system/cache/footer.php, (g) system/cache/header.php, or (h) system/cache/maintenance.php in modules/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-28T00:00:00.000Z
CVE-2007-6549 
Unspecified vulnerability in RunCMS before 1.6.1 has unknown impact and attack vectors, related to "pagetype using."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-28T00:00:00.000Z
CVE-2007-6550 
form.php in PMOS Help Desk 2.4 and earlier sends a redirect to the web browser but does not exit, which allows remote attackers to conduct eval injection attacks and execute arbitrary PHP code via the options array parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-28T00:00:00.000Z
CVE-2007-6551 
SQL injection vulnerability in showMsg.php in MailMachine Pro 2.2.4, and other versions before 2.2.6, allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-28T00:00:00.000Z
CVE-2007-6552 
Directory traversal vulnerability in index.php in AuraCMS 2.2 allows remote authenticated users to include and execute arbitrary local files via a .. (dot dot) in the act parameter, possibly involving the news pilih component; as demonstrated by including admin/admin_users.php to bypass a protection mechanism against direct request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-28T00:00:00.000Z
CVE-2007-6553 
Multiple PHP remote file inclusion vulnerabilities in TeamCal Pro 3.1.000 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the CONF[app_root] parameter to (1) tcuser.class.php, (2) absencecount.inc.php, (3) avatar.inc.php, (4) csvhandler.class.php, (5) functions.tcpro.php, (6) header.html.inc.php, (7) joomlajack.tcpro.php, (8) menu.inc.php, (9) other.inc.php, (10) tcabsence.class.php, (11) tcabsencegroup.class.php, (12) tcallowance.class.php, (13) tcannouncement.class.php, (14) tcconfig.class.php, (15) tcdaynote.class.php, (16) tcgroup.class.php, (17) tcholiday.class.php, (18) tclogin.class.php, (19) tcmonth.class.php, (20) tctemplate.class.php, (21) tcusergroup.class.php, or (22) tcuseroption.class.php in includes/, possibly a related issue to CVE-2006-4845.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-28T00:00:00.000Z
CVE-2007-6554 
Multiple directory traversal vulnerabilities in TeamCal Pro 3.1.000 and earlier allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lang parameter to (1) index.php, (2) register.php, (3) login.php, or (4) statistics.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-28T00:00:00.000Z
CVE-2007-6555 
PHP remote file inclusion vulnerability in modules/mod_pxt_latest.php in the mosDirectory (com_directory) 2.3.2 component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[mosConfig_absolute_path] parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-28T00:00:00.000Z
CVE-2007-6556 
Multiple SQL injection vulnerabilities in websihirbazi 5.1.1 allow remote attackers to execute arbitrary SQL commands via (1) the id parameter to default.asp in a news page action or (2) the pageid parameter to default.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-28T00:00:00.000Z
CVE-2007-6557 
Multiple SQL injection vulnerabilities in MeGaCheatZ 1.1 allow remote attackers to execute arbitrary SQL commands via the ItemID parameter to (1) comments.php, (2) view.php, (3) siteadmin/ViewItem.php, and unspecified other vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-12-28T00:00:00.000Z