CVE Vulnerability Catalog

A buffer overflow vulnerability in Microsoft Excel 2000 through 2003 allows an attacker to execute arbitrary code via a specially crafted .xls file with a modified COLINFO record. The attack requires user interaction to open the malicious file.

CMS Mundo 1.0 build 008 (and possibly other versions) contains multiple SQL injection vulnerabilities. A remote attacker can execute arbitrary SQL commands via the news_id, searchstring, id, username parameters, and user profile fields (Name, Address, Zip, City, Country, Email).

SQL injection vulnerability in pages.asp in ASP Stats Generator before 2.1.2 allows remote attackers to execute arbitrary SQL commands via the order parameter.

Format string vulnerability in the WriteText function in agl_text.cpp in Milan Mimica Sparklet 0.9.4 and earlier allows remote attackers to execute arbitrary code via format string specifiers in a player nickname.

SQL injection vulnerability in index.php in LifeType 1.0.5 allows remote attackers to execute arbitrary SQL commands via the Date parameter in a Default op.

SQL injection vulnerability in search.php in SenseSites CommonSense CMS 5.0 allows remote attackers to execute arbitrary SQL commands via the Date parameter. The provenance of this information is unknown; details are obtained from third party information.

SQL injection vulnerability in search.results.php in HiveMail 1.3 and earlier allows remote attackers to execute arbitrary SQL commands via the fields[] parameter.

SQL injection vulnerability in forumthread.php in Papoo 3 RC3 and earlier allows remote attackers to execute arbitrary SQL commands via the msgid parameter.

SQL injection vulnerability in topics.php in Blue Dojo Graffiti Forums 1.0 allows remote attackers to execute arbitrary SQL commands via the f parameter.

Remote file inclusion (RFI) vulnerability in Plume CMS 1.0.4 allows remote attackers to execute arbitrary PHP code by supplying a malicious URL in the _PX_config[manager_path] parameter to index.php, rss.php, or search.php. This is a different set of vectors and versions than CVE-2006-2645 and CVE-2006-0725.

auraCMS 1.62 by Arif Supriyanto contains multiple SQL injection vulnerabilities in the 'name' and 'pesan' parameters. These allow remote attackers to execute arbitrary SQL commands, including deleting all shoutbox messages.

Multiple SQL injection vulnerabilities have been found in Invision Power Board (IPB) versions 1.x and 2.x. Remote attackers can execute arbitrary SQL commands via parameters such as idcat, code, id, CODE, and member_id in various actions and files (including index.php and coins_list.php). The developer has disputed some of these vectors, stating that the CODE attribute is never present in SQL queries and that the 'ketqua' action and 'coin_list.php' file are not standard IPB 2.x features.

Directory traversal vulnerability in index.php in MKPortal 1.0.1 Final allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the language cookie. Attackers can inject PHP sequences into the error.log file using a gl_session cookie, which is then included by index.php with malicious commands accessible via the ind parameter.

A vulnerability in PlaNet Concept planetNews allows remote attackers to bypass authentication and execute arbitrary code via a direct request to news/admin/planetnews.php.

Multiple SQL injection vulnerabilities exist in Invision Power Board (IPB) 1.3 Final, allowing remote attackers to execute arbitrary SQL commands via the CODE parameter in the Stats, Mail, and Reg actions of index.php. The developer has disputed this issue, stating that the CODE parameter does not interact with the database and is only used in a SWITCH statement to select a function.

PHP remote file inclusion vulnerability in index.php in Randshop before 1.2 allows remote attackers to execute arbitrary PHP code via the dateiPfad parameter, a different vector than CVE-2006-3375.

A vulnerability in includes/editor/insert_image.php in Pivot 1.30 RC2 and earlier creates authentication credentials from request parameters. A remote attacker can modify the pass and session parameters, as well as the pass and userlevel indices of the Pivot_Vars[] or Users[] array parameters, to obtain privileges and upload arbitrary files.

Direct static code injection vulnerability in code/class_db_text.php in EJ3 TOPo 2.2.178 and earlier allows remote attackers to execute arbitrary PHP code via parameters such as descripcion and pais, which are stored directly in a PHP script.

Directory traversal vulnerability in Nullsoft SHOUTcast DSP before 1.9.6 filters directory traversal sequences before decoding, which allows remote attackers to read arbitrary files via encoded dot dot (%2E%2E) sequences in an HTTP GET request for a file path containing "/content".

PHP remote file inclusion vulnerability in skins/advanced/advanced1.php in Sabdrimer Pro 2.2.4. When register_globals is enabled, a remote attacker can execute arbitrary PHP code via the pluginpath[0] parameter containing a URL.