CVE Vulnerability Catalog

IMGallery 2.4 and earlier contains multiple SQL injection vulnerabilities in galeria.php. A remote attacker can execute arbitrary SQL commands via the start or sort parameters.

Multiple PHP remote file inclusion vulnerabilities in Nucleus 3.23 allow remote attackers to execute arbitrary PHP code via a URL in the DIR_LIBS parameter in action.php, media.php, xmlrpc/server.php, and xmlrpc/api_metaweblog.inc.php. This is similar to CVE-2006-2583, but the issue has been disputed by third parties who state that DIR_LIBS is defined in an include file before use.

SQL injection vulnerability in index.php in openCI 1.0 BETA 0.20.1 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.

SQL injection vulnerability in index.php in CavoxCms 1.0.16 and earlier allows remote attackers to execute arbitrary SQL commands via the page parameter.

phpTRADER 4.9 SP5 and earlier contains multiple SQL injection vulnerabilities. Remote attackers can execute arbitrary SQL commands via parameters such as sectio, an, who, and adnr in various script files.

SQL injection vulnerability in propview.php in Free Realty 2.9-0.7 and earlier allows remote attackers to execute arbitrary SQL commands via the sort parameter.

SQL injection vulnerability in category.php in TPL Design tplShop 2.0 and earlier allows remote attackers to execute arbitrary SQL commands via the first_row parameter.

SQL injection vulnerability in forum.php in VBZooM 1.11 allows remote attackers to execute arbitrary SQL commands via the MainID parameter.

SQL injection vulnerability in index.php in Clubpage allows remote attackers to execute arbitrary SQL commands via the category parameter.

Microsoft Excel allows user-assisted attackers to execute arbitrary javascript and redirect users to arbitrary sites via an Excel spreadsheet with an embedded Shockwave Flash Player ActiveX Object, which is automatically executed when the user opens the spreadsheet.

A memory leak exists in Network Security Services (NSS) 3.11, as used in Sun Java Enterprise System 2003Q4 through 2005Q1 and Java System Directory Server 5.2. A remote attacker can cause a denial of service (memory exhaustion) by performing a large number of RSA cryptographic operations.

SQL injection vulnerability in controlpanel/index.php in CMS Mundo before version 1.0 build 008. Remote attackers can execute arbitrary SQL commands via the username parameter.

Chipmailer 1.09 contains multiple SQL injection vulnerabilities in main.php. Remote attackers can execute arbitrary SQL commands through various parameters such as anfang, name, mail, anrede, vorname, nachname, gebtag, gebmonat, and gebjahr.

iPostMX 2005 version 2.0 and earlier contains multiple SQL injection vulnerabilities. A remote attacker can execute arbitrary SQL commands via the 'forum' parameter in messagepost.cfm and the 'topic' parameter in topics.cfm.

PhpMyFactures 1.2 and earlier allows remote attackers to bypass authentication and modify data via direct requests with modified parameters to eight PHP scripts, including those adding and modifying VAT rates, discounts, countries, product categories, products, and clients.

Stack-based buffer overflow in the HrShellOpenWithMonikerDisplayName function in Microsoft Hyperlink Object Library (hlink.dll). A remote attacker can cause a denial of service (crash) and possibly execute arbitrary code via a long hyperlink, as demonstrated using an Excel worksheet with a long link in Unicode.

SQL injection vulnerability in the add_hit function in include/function.inc.php in Coppermine Photo Gallery (CPG) 1.4.8, when "Keep detailed hit statistics" is enabled. Remote attackers can execute arbitrary SQL commands via the referer and user-agent HTTP headers.

PHP remote file inclusion vulnerability in DoubleSpeak 0.1, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via the config[private] parameter in multiple files, as demonstrated by index.php, faq.php, and hardware.php. The issue has been disputed by multiple third-party researchers who state that config[private] is initialized in an include file before being used.

SQL injection vulnerability in phpBannerExchange before 2.0 Update 6 allows remote attackers to execute arbitrary SQL commands via the login parameter in client/stats.php and admin/stats.php, or the pass parameter in client/stats.php.

Multiple PHP remote file inclusion vulnerabilities exist in PictureDis Professional 1.33 Build 234 and earlier, and PictureDis Photoalbum 4.82 and earlier. Remote attackers can execute arbitrary PHP code by passing a malicious URL in the lang parameter to files in the photoalbum/ directory, including thumstbl.php, wpfiles.php, and wallpapr.php.