CVE Vulnerability Catalog

A format string vulnerability in the SMTP service of IMail Server 8.20 in Ipswitch Collaboration Suite (ICS) before version 2.02 allows remote attackers to execute arbitrary code by sending crafted format specifiers to the EXPN, MAIL, MAIL FROM, and RCPT TO commands.

SQL injection vulnerability in comentarii.php in Web4Future Portal Solutions News Portal allows remote attackers to execute arbitrary SQL commands via the idp parameter.

SQL injection vulnerability in FileLister 0.51 and earlier allows remote attackers to execute arbitrary SQL commands via the search parameters, possibly the searchwhat parameter to definesearch.jsp.

Eval injection vulnerability in MediaWiki 1.5.x before 1.5.3 allows remote attackers to execute arbitrary PHP code via the 'user language option,' which is used as part of a dynamic class name that is processed using the eval function.

SQL injection vulnerability in view.php in Hobosworld HobSR 1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) arrange and (2) p parameters.

SQL injection vulnerability in functions.php in Web4Future Affiliate Manager PRO 4.1 and earlier allows remote attackers to execute arbitrary SQL commands via the pid parameter.

Multiple SQL injection vulnerabilities in Web4Future eDating Professional 5 allow remote attackers to execute arbitrary SQL commands via the s, pg, sortb parameters in index.php, cid in gift.php and fq.php, and cat in articles.php.

Multiple SQL injection vulnerabilities in Web4Future eCommerce Enterprise Edition 2.1 and earlier allow remote attackers to execute arbitrary SQL commands via the prod, brid, bid, grp, and cat parameters in view.php, viewbrands.php, and index.php.

Directory traversal vulnerability in arhiva.php in Web4Future Portal Solutions News Portal allows remote attackers to read arbitrary files via the dir parameter.

SQL injection vulnerability in KBase Express 1.0.0 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter in category.php and search parameters in search.php.

Multiple SQL injection vulnerabilities in PHP Lite Calendar Express 2.2 and earlier allow remote attackers to execute arbitrary SQL commands via the cid and catid parameters in day.php, week.php, month.php, and year.php.

SQL injection vulnerability in Widget Property 1.1.19 allows remote attackers to execute arbitrary SQL commands via the property_id, zip_code, property_type_id, price, and city_id parameters to property.php.

SQL injection vulnerability in index.php in Relative Real Estate Systems 1.02 and earlier allows remote attackers to execute arbitrary SQL commands via the mls parameter.

The vulnerability in Help Desk Reloaded Free Help Desk is that the install.php file is not removed or protected after installation is complete. A remote attacker can send a direct request to install.php, then navigate to accountsetup.php and create a new user account, leading to unauthorized privilege escalation.

SQL injection vulnerability in SimpleBBS 1.1 allows remote attackers to execute arbitrary SQL commands via unspecified search module parameters.

SQL injection vulnerability in calendar.php in Codewalkers ltwCalendar (aka PHP Event Calendar) 4.2, 4.1.3, and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.

SQL injection vulnerability in create.php of Widget Imprint 1.0.26 and earlier allows remote attackers to execute arbitrary SQL commands via the product_id parameter.

SQL injection vulnerability in ls.php of Landshop Real Estate Commerce System 0.6.3 and earlier allows remote attackers to execute arbitrary SQL commands via the start, search_order, search_type, search_area, and keyword parameters.

Vulnerability in stat.php in PHP Web Statistik 1.4 allows remote attackers to cause a denial of service (CPU consumption) via a large lastnumber value.

SQL injection vulnerability in jax_calendar.php in Jax Calendar 1.34 allows remote attackers to execute arbitrary SQL commands via the cal_id parameter, and possibly the Y and m parameters.