CVE Vulnerability Catalog

PHP remote file inclusion vulnerability in board/post.php in free QBoard 1.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the qb_path parameter.

PHP remote file inclusion vulnerability in inc/design.inc.php in LoveCompass aePartner 0.8.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the dir[data] parameter.

SQL injection vulnerability in vs_search.php of Arantius Vice Stats before version 1.0.1 allows remote attackers to execute arbitrary SQL commands via unknown vectors. This issue is distinct from CVE-2006-2972.

SQL injection vulnerability in block_forum_topic_new.php of ViArt Shop Free 2.5.5 and other distributions (Light, Standard, Enterprise) allows remote attackers to execute arbitrary SQL commands via unknown vectors, likely involving the forum_id parameter.

SQL injection vulnerability in vs_resource.php of Arantius Vice Stats versions 0.5b and 1.0. Remote attackers can execute arbitrary SQL commands via the ID parameter.

Unspecified vulnerability in usermgr.php in Coppermine Photo Gallery before version 1.4.7. It may allow remote attacks with unknown impact, possibly related to authorization or authentication errors.

SQL injection vulnerability in big.php of Mafia Moblog 0.6M1 and earlier. Remote attackers can execute arbitrary SQL commands via the img parameter.

Multiple SQL injection vulnerabilities in month.php of PHP Lite Calendar Express 2.2 allow remote attackers to execute arbitrary SQL commands via the catid and cid parameters.

A remote file inclusion vulnerability in Joomla! 1.0 allows attackers to execute arbitrary PHP code by supplying a URL in the 'includepath' parameter in includes/joomla.php.

SQL injection vulnerability in inc_header.asp in Snitz Forum 3.4.05 and earlier allows remote attackers to execute arbitrary SQL commands via the %strCookieURL%.GROUP parameter in a cookie.

A stack-based buffer overflow in CesarFTP 0.99g and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a long MKD command.

A PHP remote file inclusion vulnerability in sql_fcnsOLD.php of Emergenices Personnel Information System (Empris) 20020923 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the phormationdir parameter.

Xtreme Scripts Download Manager 1.0 contains multiple PHP remote file inclusion vulnerabilities. An attacker can execute arbitrary PHP code remotely by supplying a malicious URL in the 'root' parameter in several scripts, including download.php and manager.php.

SQL injection vulnerability in files.asp in OfficeFlow 2.6 and earlier allows remote attackers to execute arbitrary SQL commands via the Project parameter.

An unspecified vulnerability in CGI-RESCUE WebFORM 4.1 and earlier allows remote attackers to inject email headers, facilitating spam sending. Details are obtained from third-party information.

A stack-based buffer overflow in the WWW Proxy Server of Qbik WinGate 6.1.1.1077 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long URL HTTP request.

Multiple SQL injection vulnerabilities were found in SelectaPix 1.31. An attacker can remotely execute arbitrary SQL commands via the albumID, imageID, username, and password parameters.

An unspecified vulnerability in Microsoft NetMeeting 3.01 allows remote attackers to cause a denial of service (crash or CPU consumption) and possibly execute arbitrary code via crafted inputs that trigger memory corruption.

A buffer overflow vulnerability exists in the t2p_write_pdf_string function of tiff2pdf in libtiff versions 3.8.2 and earlier. An attacker can exploit a specially crafted TIFF file with a DocumentName tag containing UTF-8 characters, causing a crash and potentially arbitrary code execution.

SQL injection vulnerability in index.php of Partial Links 1.2.2 allows remote attackers to execute arbitrary SQL commands via the topic parameter.