CVE Vulnerability Catalog

APBoard 2.2-r3 and earlier contain multiple SQL injection vulnerabilities. Remote attackers can execute arbitrary SQL commands via the PHPSESSID parameter in board.php and the viewcatmod parameter in main.php.

SQL injection vulnerability in engine/shards/blog.php in blur6ex 0.3.462 allows remote attackers to execute arbitrary SQL commands via the ID parameter in a proc_reply action in the blog shard.

Unspecified vulnerability in Microsoft Excel 2000 through 2004 allows remote user-assisted attackers to execute arbitrary code via unspecified vectors. This is a different vulnerability than CVE-2006-3086.

VBZooM 1.11 contains multiple SQL injection vulnerabilities in the sobjectID and MAINID parameters in show.php and the MainID parameter in subject.php. A remote attacker can execute arbitrary SQL commands.

Remote file inclusion (RFI) vulnerability in manage_songs.php in Foing 0.7.0e and earlier allows remote attackers to execute arbitrary PHP code by supplying a malicious URL in the foing_root_path parameter.

TikiWiki 1.9.3.2 and possibly earlier versions contain an SQL injection vulnerability. Remote attackers can execute arbitrary SQL commands via unknown attack vectors.

VBZooM 1.02 contains multiple SQL injection vulnerabilities. A remote attacker can execute arbitrary SQL commands via the QuranID, ShowByQuranID, or Action parameters in meaning.php.

SQL injection vulnerability in language.php in VBZooM 1.01 allows remote attackers to execute arbitrary SQL commands via the Action parameter.

A PHP remote file inclusion vulnerability in common.php in PHORUM 5.1.13 and earlier was reported to allow remote attackers to execute arbitrary PHP code via the PHORUM[http_path] parameter. The vendor disputed the issue, stating that common.php checks on the very first line of non-comment code that it is not being called directly, as has been the case in all 5.x versions. CVE analysis concurs with the vendor.

In PicoZip 4.01, the info tip shell extension (zipinfo.dll) has a stack-based buffer overflow. An attacker can remotely execute arbitrary code by placing a long filename in an ACE, RAR, or ZIP archive, triggered when the user hovers the mouse over the archive.

The vulnerability in artswrapper in aRts, when running setuid root on Linux 2.6.0 or later, does not check the return value of the setuid function call. This allows local users to gain root privileges by causing setuid to fail, preventing artsd from dropping privileges.

A reported PHP remote file inclusion vulnerability in talkbox.php in Amr Talkbox was said to allow remote attackers to execute arbitrary PHP code via the direct parameter. However, the issue has been disputed by CVE, since the $direct variable is set to a static value just before the include statement.

Multiple SQL injection vulnerabilities exist in Enthrallwebe ePhotos 2.2 and earlier. A remote attacker can execute arbitrary SQL commands via the CAT_ID parameter in subphotos.asp and subLevel2.asp, the AL_ID parameter in photo.asp, and the SUB_ID parameter in subLevel2.asp.

A reported PHP remote file inclusion vulnerability in Ltwcalendar/calendar.php in Codewalkers Ltwcalendar 4.1.3 could allow remote attackers to execute arbitrary PHP code via the ltw_config[include_dir] parameter. CVE disputes this claim, as the $ltw_config[include_dir] variable is defined as a static value in an include file before being referenced in an include() statement.

phpCMS 1.2.1pl2 contains multiple PHP remote file inclusion (RFI) vulnerabilities in files under parser/include/ and parser/plugs/. An attacker can supply a malicious URL in the PHPCMS_INCLUDEPATH parameter to execute arbitrary PHP code on the server.

Multiple PHP remote file inclusion vulnerabilities exist in ISPConfig 2.2.3. A remote attacker can execute arbitrary PHP code by supplying a malicious URL in the go_info[isp][classes_root] or go_info[server][classes_root] parameters in server.inc.php, app.inc.php, login.php, and trylogin.php. The vendor has disputed this issue, stating that the original researcher reviewed an installation tarball that differs from the system after installation.

PHP remote file inclusion vulnerability in stat_modules/users_age/module.php in Minerva 2.0.8a Build 237 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.

Unspecified vulnerability in the session extension functionality in PHP before 5.1.3 has unknown impact and attack vectors related to heap corruption.

Unspecified vulnerability in session.c in PHP before 5.1.3 involves unknown impact and attack vectors related to certain characters in session names, including special characters associated with CRLF injection, SQL injection, XSS, and HTTP response splitting. PHP applications expect session names to be alphanumeric, as implied in the PHP manual for session_name().

A vulnerability in zend_hash_del_key_or_index in zend_hash.c in PHP before 4.4.3 and 5.x before 5.1.3 can cause zend_hash_del to delete the wrong element. This prevents a variable from being unset even when the PHP unset function is called, potentially leading to its value being used in security-relevant operations.