CVE Vulnerability Catalog

Unspecified vulnerability in the CHM unpacker in avast! before version 4.7.844. The impact and attack vectors are unknown.

SQL injection vulnerability in viewmsg.asp of LocazoList Classifieds 1.05e allows remote attackers to execute arbitrary SQL commands via the msgid parameter.

SQL injection vulnerability in LifeType 1.0.4 allows remote attackers to execute arbitrary SQL commands via the articleId parameter in the ViewArticle action.

A PHP remote file inclusion vulnerability in Bytehoard 2.1 Epsilon/Delta allows remote attackers to execute arbitrary PHP code via the bhconfig[bhfilepath] parameter in includes/webdav/server.php.

A vulnerability in CyBoards PHP Lite 1.25 in include/common.php allows remote code execution via the script_path parameter. However, CVE disputes this issue as script_path is set to a constant value.

SQL injection vulnerability in comment.php of Pineapple Technologies Lore 1.5.6 and earlier allows remote attackers to execute arbitrary SQL commands via the article_id parameter.

A PHP remote file inclusion vulnerability in includes/common.php of gnopaste 0.5.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the root_path parameter.

SQL injection vulnerability in viewimage.php in Particle Gallery 1.0.0 and earlier allows remote attackers to execute arbitrary SQL commands via the imageid parameter.

SQL injection vulnerability in editpost.php in CoolForum 0.8.3 beta and earlier allows remote attackers to execute arbitrary SQL commands via the post parameter.

A PHP remote file inclusion vulnerability in Redaxo versions 3.0 through 3.2 allows remote attackers to execute arbitrary PHP code by supplying a malicious URL in the REX[INCLUDE_PATH] parameter to image_resize/pages/index.inc.php.

SQL injection vulnerability in links.asp in aspWebLinks 2.0 allows remote attackers to execute arbitrary SQL commands via the linkID parameter.

SQL injection vulnerability in index.php of xueBook 1.0 allows remote attackers to execute arbitrary SQL commands via the 'start' parameter.

Drupal 4.6.x before 4.6.8 and 4.7.x before 4.7.2, under certain Apache configurations (e.g., when FileInfo overrides are disabled in .htaccess), allows remote attackers to execute arbitrary code by uploading a file with multiple extensions. This is a variant of CVE-2006-2743.

A buffer overflow in TIBCO Rendezvous before 7.5.1, TIBCO Runtime Agent (TRA) before 5.4, and Hawk before 4.6.1 allows a remote attacker to cause a denial of service and potentially execute arbitrary code via the HTTP administrative interface.

PHP remote file inclusion vulnerability in common-menu.php of Informium 0.12.0. An attacker can execute arbitrary PHP code by sending a crafted URL in the CONF[local_path] parameter.

The SMTP server in Apache Java Mail Enterprise Server (Apache James) 2.2.0 allows remote attackers to cause a denial of service (CPU consumption) by sending a long argument to the MAIL command.

ASPwebSoft Speedy Asp Discussion Forum allows remote attackers to change the password of any account via a modified account ID and possibly arbitrary values of the name, email, country, password, and passwordre parameters to profileupdate.asp.

Cantico Ovidentia 5.8.0 contains multiple PHP remote file inclusion vulnerabilities. An attacker can remotely execute arbitrary PHP code by sending a crafted URL in the babInstallPath parameter to many scripts.

SQL injection vulnerability in bolum.php in tekno.Portal allows remote attackers to execute arbitrary SQL commands via the id parameter. The details are obtained solely from third party information.

SQL injection vulnerability in admin/default.asp of Dusan Drobac CodeAvalanche FreeForum (CAForum) 1.0 allows remote attackers to execute arbitrary SQL commands via the password parameter.