CVE Vulnerability Catalog

SQL injection vulnerability in MgrLogin.asp of Addsoft StoreBot 2005 Professional allows remote attackers to execute arbitrary SQL commands via the Pwd parameter. The details are obtained solely from third party information.

In SMartBlog (SMBlog) 1.2, the index.php file contains a remote file inclusion vulnerability. An attacker can use the pg parameter or a query string without a parameter to include and execute arbitrary PHP code from an external source.

WordPress 1.5.2 (and possibly earlier versions before 2.0) contains an SQL injection vulnerability in the User-Agent field of the HTTP header when posting a comment. A remote attacker can exploit this to execute arbitrary SQL commands on the database.

Multiple SQL injection vulnerabilities in Pentacle In-Out Board 3.0 and earlier allow remote attackers to execute arbitrary SQL commands and bypass authentication via the newsid parameter in newsdetailsview.asp and the password parameter in login.asp.

Multiple SQL injection vulnerabilities exist in sendcard.php in sendcard before version 3.3.0. Remote attackers can execute arbitrary SQL commands via unspecified parameters.

The NETGEAR WGT624 wireless DSL router has a default account with username "Gearguy" and password "Geardog", allowing remote attackers to modify the device configuration. Note that not all WGT624 routers may be affected.

Multiple SQL injection vulnerabilities in N8cms versions 1.1 and 1.2 allow remote attackers to execute arbitrary SQL commands via the dir and page_id parameters to index.php.

PHP remote file inclusion vulnerability in index.php of Top sites de PixelArtKingdom allows attackers to include and execute arbitrary files via the 'page' parameter.

Unspecified vulnerability in the local weblog publisher in Nidelven IT Issue Dealer before version 0.9.96. Impact and attack vectors are unknown.

SQL injection vulnerability in topics.php of phpWebSite 0.10.2 and earlier allows remote attackers to execute arbitrary SQL commands via the topic parameter.

A PHP remote file inclusion vulnerability in index.php of one or more ActiveCampaign products, likely SupportTrio, allows remote attackers to include and execute arbitrary files via the page parameter.

The default configuration of ISC BIND before 9.4.1-P1, when configured as a caching name server, allows recursive queries and provides additional delegation information to arbitrary IP addresses. This allows remote attackers to cause a denial of service (traffic amplification) via DNS queries with spoofed source IP addresses.

The default configuration of the DNS Server service on Windows Server 2003, Windows 2000, and Microsoft DNS Server on Windows NT 4.0 allows recursive queries and provides additional delegation information to arbitrary IP addresses. This enables remote attackers to cause a denial of service (traffic amplification) via DNS queries with spoofed source IP addresses.

SQL injection vulnerability in vuBB 0.2 allows remote attackers to execute arbitrary SQL commands via the 'pass' parameter in a cookie.

SQL injection vulnerability in yazdir.asp in Cilem Hiber 1.1 allows remote attackers to execute arbitrary SQL commands via the haber_id parameter. This product is also referred to as Cilem News.

The ncprwsnt service in NCP Network Communication Secure Client 8.11 Build 146 (and possibly other versions) allows local users to execute arbitrary code by modifying the connect.bat script, which is automatically executed by the service after a connection is established.

A direct static code injection vulnerability in func.inc.php in freeForum before 1.2.1 allows remote attackers to execute arbitrary PHP code via the X-Forwarded-For and Client-Ip HTTP headers, which are stored in Data/flood.db.php.

SQL injection vulnerability in misc.php in MyBulletinBoard (MyBB) 1.03 (and 1.04) allows remote attackers to execute arbitrary SQL commands by setting the comma variable via the comma parameter in a cookie when register_globals is enabled.

A vulnerability in the automount service in Mac OS X 10.4.5 and earlier allows remote file servers to cause a denial of service (unresponsiveness) or execute arbitrary code via unspecified vectors that cause automount to mount file systems with reserved names.

SQL injection vulnerability in DCI-Taskeen 1.03 allows remote attackers to execute arbitrary SQL commands via the id or action parameter in basket.php, or id or page parameter in cat.php.