rainbutterfly/cve_corpus huggingface dataset:
CVE-2008-6749 
Multiple SQL injection vulnerabilities in admin/usercheck.php in FlexPHPDirectory 0.0.1, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) checkuser and (2) checkpass parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-24T14:00:00.000Z
CVE-2008-6750 
Unrestricted file upload vulnerability in add.php in FlexPHPDirectory 0.0.1 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in photo/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-24T14:00:00.000Z
CVE-2008-6751 
Unrestricted file upload vulnerability in index.php in the Twitter Clone (TClone) plugin for ReVou Micro Blogging allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in settings/my_photo.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-24T14:00:00.000Z
CVE-2008-6752 
adminlogin/password.php in the Twitter Clone (TClone) plugin for ReVou Micro Blogging does not verify the original password before changing passwords, which allows remote attackers to change the administrator's password and gain privileges via a direct request with modified newpass1 and newpass2 parameters in a Change operation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-24T14:00:00.000Z
CVE-2008-6753 
SQL injection vulnerability in SilverStripe before 2.2.2 allows remote attackers to execute arbitrary SQL commands via unspecified vectors related to AjaxUniqueTextField.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-27T17:43:00.000Z
CVE-2008-6754 
The Personal Sticky Threads addon 1.0.3c for vBulletin allows remote authenticated users to read the title, author, and pages of an arbitrary thread by toggling a personal sticky.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-27T19:00:00.000Z
CVE-2008-6755 
ZoneMinder 1.23.3 on Fedora 10 sets the ownership of /etc/zm.conf to the apache user account, and sets the permissions to 0600, which makes it easier for remote attackers to modify this file by accessing it through a (1) PHP or (2) CGI script.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-27T22:00:00.000Z
CVE-2008-6756 
ZoneMinder 1.23.3 on Gentoo Linux uses 0644 permissions for /etc/zm.conf, which allows local users to obtain the database username and password by reading this file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-27T22:00:00.000Z
CVE-2008-6757 
Cross-site scripting (XSS) vulnerability in manuals_search.php in ViArt Shop (aka Shopping Cart) 3.5 allows remote attackers to inject arbitrary web script or HTML via the manuals_search parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-28T16:00:00.000Z
CVE-2008-6758 
Cross-site request forgery (CSRF) vulnerability in cart_save.php in ViArt Shop (aka Shopping Cart) 3.5 allows remote attackers to hijack the authentication of arbitrary users for requests that conduct persistent cross-site scripting (XSS) attacks via the cart_name parameter in a save action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-28T16:00:00.000Z
CVE-2008-6759 
ViArt Shop (aka Shopping Cart) 3.5 allows remote attackers to obtain sensitive information via a URL in the POST_DATA parameter to manuals_search.php, which reveals the installation path in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-28T16:00:00.000Z
CVE-2008-6760 
ViArt Shop (aka Shopping Cart) 3.5 allows remote attackers to obtain sensitive information via an unauthenticated add and save action for a shopping cart in cart_save.php, which reveals the SQL table names in an error message, related to code that mishandles the lack of a user_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-28T16:00:00.000Z
CVE-2008-6761 
Static code injection vulnerability in admin/install.php in Flexcustomer 0.0.6 might allow remote attackers to inject arbitrary PHP code into const.inc.php via the installdbname parameter (aka the Database Name field).  NOTE: the installation instructions specify deleting admin/install.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-28T16:00:00.000Z
CVE-2008-6762 
Open redirect vulnerability in wp-admin/upgrade.php in WordPress, probably 2.6.x, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the backto parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-28T16:00:00.000Z
CVE-2008-6763 
login2.php in Silentum LoginSys 1.0.0 allows remote attackers to bypass authentication and obtain access to an arbitrary account by setting the logged_in cookie to that account's username.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-28T16:00:00.000Z
CVE-2008-6764 
Cross-site scripting (XSS) vulnerability in login.php in Silentum LoginSys 1.0.0 allows remote attackers to inject arbitrary web script or HTML via the message parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-28T16:00:00.000Z
CVE-2008-6765 
ViArt Shop (aka Shopping Cart) 3.5 allows remote attackers to access the contents of an arbitrary shopping cart via a modified cart_name parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-28T16:00:00.000Z
CVE-2008-6766 
cart_save.php in ViArt Shop (aka Shopping Cart) 3.5 allows remote attackers to cause a denial of service (excessive shopping carts) via a flood of requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-28T16:00:00.000Z
CVE-2008-6767 
wp-admin/upgrade.php in WordPress, probably 2.6.x, allows remote attackers to upgrade the application, and possibly cause a denial of service (application outage), via a direct request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-28T16:00:00.000Z
CVE-2008-6768 
Unrestricted file upload vulnerability in admin/editor/images.php in K&S Shopsoftware allows remote attackers to execute arbitrary PHP code by uploading a file with an executable extension, then accessing it via a direct request to the file in images/upload/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-29T18:06:00.000Z
CVE-2008-6769 
Unrestricted file upload vulnerability in upload.php in YourPlace 1.0.2 and earlier allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-29T18:06:00.000Z
CVE-2008-6770 
YourPlace 1.0.2 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to a database containing user credentials via a direct request for users.txt.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-29T18:06:00.000Z
CVE-2008-6771 
YourPlace 1.0.2 and earlier allows remote attackers to obtain sensitive system information via a direct request via a direct request to user/uploads/phpinfo.php, which calls the phpinfo function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-29T18:06:00.000Z
CVE-2008-6772 
login/register_form.php in YourPlace 1.0.2 and earlier does not check that a username already exists when a new account is created, which allows remote attackers to bypass intended access restrictions by registering a new account with the username of a target user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-29T18:06:00.000Z
CVE-2008-6773 
Static code injection vulnerability in user/internettoolbar/edit.php in YourPlace 1.0.2 and earlier allows remote authenticated users to execute arbitrary PHP code into user/internettoolbar/index.php via the (1) fav1_url, (2) fav1_name, (3) fav2_url, (4) fav2_name, (5) fav3_url, (6) fav3_name, (7) fav4_url, (8) fav4_name, (9) fav5_url, or (10) fav5_name parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-29T18:06:00.000Z
CVE-2008-6774 
internettoolbar/edit.php in YourPlace 1.0.2 and earlier does not end execution when an invalid username is detected, which allows remote attackers to bypass intended restrictions and edit toolbar settings via an invalid username.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-29T18:06:00.000Z
CVE-2008-6775 
HTC Touch Pro and HTC Touch Cruise vCard allows remote attackers to cause denial of service (CPU consumption, SMS consumption, and connectivity loss) via a flood of vCards to UDP port 9204.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-01T16:00:00.000Z
CVE-2008-6776 
SQL injection vulnerability in viewcomments.php in Scripts For Sites (SFS) EZ Hot or Not allows remote attackers to execute arbitrary SQL commands via the phid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-01T17:00:00.000Z
CVE-2008-6777 
Multiple SQL injection vulnerabilities in MyPHP Forum 3.0 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in a confirm action, the (2) user parameter in a newconfirm action, and (3) reqpwd action to member.php; and the (4) quote parameter in a post action and (5) pid parameter in an edit action to post.php, different vectors than CVE-2005-0413.2 and CVE-2007-6667.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-01T17:00:00.000Z
CVE-2008-6778 
SQL injection vulnerability in viewfaqs.php in Scripts for Sites (SFS) EZ Auction allows remote attackers to execute arbitrary SQL commands via the cat parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-01T17:00:00.000Z
CVE-2008-6779 
SQL injection vulnerability in the Sarkilar module for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the id parameter in a showcontent action to modules.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-01T17:00:00.000Z
CVE-2008-6780 
SQL injection vulnerability in directory.php in Scripts for Sites (SFS) SFS EZ Affiliate allows remote attackers to execute arbitrary SQL commands via the cat_id parameter in a list action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-01T17:00:00.000Z
CVE-2008-6781 
SQL injection vulnerability in directory.php in Sites for Scripts (SFS) Gaming Directory allows remote attackers to execute arbitrary SQL commands via the cat_id parameter in a list action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-01T17:00:00.000Z
CVE-2008-6782 
SQL injection vulnerability in directory.php in Sites for Scripts (SFS) EZ Hosting Directory allows remote attackers to execute arbitrary SQL commands via the cat_id parameter in a list action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-01T17:00:00.000Z
CVE-2008-6783 
SQL injection vulnerability in directory.php in Sites for Scripts (SFS) EZ Home Business Directory allows remote attackers to execute arbitrary SQL commands via the cat_id parameter in a list action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-01T17:00:00.000Z
CVE-2008-6784 
SQL injection vulnerability in directory.php in Scripts For Sites (SFS) EZ Adult Directory allows remote attackers to execute arbitrary SQL commands via the cat_id parameter in a list action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-01T17:00:00.000Z
CVE-2008-6785 
Unrestricted file upload vulnerability in Mini File Host 1.5 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in an unspecified directory, as demonstrated by creating a name.php file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-01T18:00:00.000Z
CVE-2008-6786 
Multiple directory traversal vulnerabilities in geekigeeki.py in GeekiGeeki before 3.0 allow remote attackers to read arbitrary files via directory traversal sequences in a pagename argument in the (1) handle_edit and (2) handle_raw functions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-01T18:00:00.000Z
CVE-2008-6787 
SQL injection vulnerability in administrator/index.php in Lizardware CMS 0.6.0 and earlier allows remote attackers to execute arbitrary SQL commands via the user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-01T18:00:00.000Z
CVE-2008-6788 
SQL injection vulnerability in MindDezign Photo Gallery 2.2, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the id parameter in an info action to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-04T18:22:00.000Z
CVE-2008-6789 
SQL injection vulnerability in MindDezign Photo Gallery 2.2 allows remote attackers to execute arbitrary SQL commands via the username parameter in a login action to the admin module in index.php, a different vector than CVE-2008-6788.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-04T18:22:00.000Z
CVE-2008-6790 
The admin module in MindDezign Photo Gallery 2.2 allows remote attackers to add administrative users and gain privileges via a modified username parameter in an edit account action to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-04T18:22:00.000Z
CVE-2008-6791 
PumpKIN TFTP Server 2.7.2.0 allows remote attackers to cause a denial of service via a write request with a long mode field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-04T18:22:00.000Z
CVE-2008-6792 
system-tools-backends before 2.6.0-1ubuntu1.1 in Ubuntu 8.10, as used by "Users and Groups" in GNOME System Tools, hashes account passwords with 3DES and consequently limits effective password lengths to eight characters, which makes it easier for context-dependent attackers to successfully conduct brute-force password attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-07T17:00:00.000Z
CVE-2008-6793 
The get_file_type function in lib/file_content.php in DFLabs PTK 0.1, 0.2, and 1.0 allows remote attackers to execute arbitrary commands via shell metacharacters after an arg1= sequence in a filename within a forensic image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-07T17:00:00.000Z
CVE-2008-6794 
SQL injection vulnerability in directory.php in Scripts For Sites (SFS) EZ Pub Site allows remote attackers to execute arbitrary SQL commands via the cat parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-07T17:00:00.000Z
CVE-2008-6795 
SQL injection vulnerability in view_news.php in nicLOR Vibro-School-CMS allows remote attackers to execute arbitrary SQL commands via the nID parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-07T17:00:00.000Z
CVE-2008-6796 
SQL injection vulnerability in manager/login.php in Pre Projects Pre Real Estate Listings allows remote attackers to execute arbitrary SQL commands via the username1 parameter (aka the Admin field or Username field).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-07T17:00:00.000Z
CVE-2008-6797 
The server in Mitel NuPoint Messenger R11 and R3 sends usernames and passwords in cleartext to Exchange servers, which allows remote attackers to obtain sensitive information by sniffing the network.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-07T18:00:00.000Z
CVE-2008-6798 
Multiple SQL injection vulnerabilities in login.php in Pre Projects Pre Real Estate Listings allow remote attackers to execute arbitrary SQL commands via (1) the us parameter (aka the Username field) or (2) the ps parameter (aka the Password field).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-07T18:00:00.000Z
CVE-2008-6799 
connection.php in FlashChat 5.0.8 allows remote attackers to bypass the role filter mechanism and gain administrative privileges by setting the s parameter to "7."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-07T23:00:00.000Z
CVE-2008-6801 
Cross-site request forgery (CSRF) vulnerability in Vivvo CMS before 4.0.4 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-07T23:00:00.000Z
CVE-2008-6802 
Multiple SQL injection vulnerabilities in index.php in phPhotoGallery 0.92 allow remote attackers to execute arbitrary SQL commands via the (1) Username and (2) Password fields.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-07T23:00:00.000Z
CVE-2008-6803 
SQL injection vulnerability in diziler.asp in Yigit Aybuga Dizi Portali allows remote attackers to execute arbitrary SQL commands via the id parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-11T20:00:00.000Z
CVE-2008-6804 
Tribiq CMS 5.0.9a beta allows remote attackers to bypass authentication and gain administrative access by setting the COOKIE_LAST_ADMIN_USER and COOKIE_LAST_ADMIN_LANG cookies.  NOTE: a third party reports that the vendor disputes the existence of this issue
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-11T20:00:00.000Z
CVE-2008-6805 
Multiple SQL injection vulnerabilities in Mic_Blog 0.0.3, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) cat parameter to category.php, the (2) user parameter to login.php, and the (3) site parameter to register.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-11T20:00:00.000Z
CVE-2008-6806 
Unrestricted file upload vulnerability in includes/imageupload.php in 7Shop 1.1 and earlier allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in images/artikel/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-12T16:00:00.000Z
CVE-2008-6807 
PHP remote file inclusion vulnerability in ListRecords.php in osprey 1.0a4.1 allows remote attackers to execute arbitrary PHP code via a URL in the xml_dir parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.  NOTE: the lib_dir vector is already covered by CVE-2006-6630.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-12T16:00:00.000Z
CVE-2008-6808 
SQL injection vulnerability in links.php in Scripts for Sites (SFS) EZ Link Directory allows remote attackers to execute arbitrary SQL commands via the cat_id parameter in a list action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-12T16:00:00.000Z
CVE-2008-6809 
SQL injection vulnerability in hotel_habitaciones.php in Venalsur Booking Centre Booking System for Hotels Group 2.01 allows remote attackers to execute arbitrary SQL commands via the HotelID parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-17T16:00:00.000Z
CVE-2008-6810 
Multiple SQL injection vulnerabilities in admin/checklogin.php in Venalsur Booking Centre Booking System for Hotels Group 2.01 allow remote attackers to execute arbitrary SQL commands via the (1) myusername (username) and (2) password parameters.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-17T16:00:00.000Z
CVE-2008-6811 
Unrestricted file upload vulnerability in image_processing.php in the e-Commerce Plugin 3.4 and earlier for Wordpress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in wp-content/plugins/wp-shopping-cart/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-17T16:00:00.000Z
CVE-2008-6812 
SQL injection vulnerability in bukutamu.php in phpWebNews 0.2 MySQL Edition allows remote attackers to execute arbitrary SQL commands via the det parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-21T18:00:00.000Z
CVE-2008-6813 
SQL injection vulnerability in index.php in phpWebNews 0.2 MySQL Edition allows remote attackers to execute arbitrary SQL commands via the id_kat parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-21T18:00:00.000Z
CVE-2008-6814 
Unrestricted file upload vulnerability in image_upload.php in the SimpleBoard (com_simpleboard) component 1.0.1 and earlier for Mambo allows remote attackers to execute arbitrary code by uploading a file with an executable extension and an image/jpeg content type, then accessing this file via a direct request to the file in components/com_simpleboard/, a different vulnerability than CVE-2006-3528.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-28T14:00:00.000Z
CVE-2008-6815 
mykdownload.php in MyKtools 2.4 does not require administrative authentication, which allows remote attackers to read a database backup by making a direct request, and then sending an unspecified request to the download page for the backup.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-28T14:00:00.000Z
CVE-2008-6816 
Eaton MGEOPS Network Shutdown Module before 3.10 Build 13 allows remote attackers to execute arbitrary code by adding a custom action to the MGE frontend via pane_actionbutton.php, and then executing this action via exec_action.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-28T14:00:00.000Z
CVE-2008-6817 
Mole Group Lastminute Script 4.0 and earlier stores passwords in cleartext, which allows context-dependent attackers to obtain sensitive information.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-06-01T14:00:00.000Z