VYPR

CVEs

343,040 total · page 6573 of 6,861

AllCriticalHighKEV
  • CVE-2005-3193Dec 7, 2005
    Xpdf
    Xpdf
    risk 0.00cvss —epss 0.04

    Heap-based buffer overflow in the JPXStream::readCodestream function in the JPX stream parsing code (JPXStream.c) for xpdf 3.01 and earlier, as used in products such as (1) Poppler, (2) teTeX, (3) KDE kpdf, (4) CUPS, and (5) libextractor allows user-assisted attackers to cause a…

  • CVE-2005-4030Dec 6, 2005
    Quicksilver Forums
    Quicksilver Forums
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in Quicksilver Forums before 1.5.1 allows remote attackers to execute arbitrary SQL commands via the HTTP_USER_AGENT header.

  • CVE-2005-4031Dec 6, 2005
    MediaWiki
    Mediawiki
    risk 0.00cvss —epss 0.03

    Eval injection vulnerability in MediaWiki 1.5.x before 1.5.3 allows remote attackers to execute arbitrary PHP code via the "user language option," which is used as part of a dynamic class name that is processed using the eval function.

  • CVE-2005-4032Dec 6, 2005
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in search.cgi in Easy Search System 1.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the q parameter.

  • CVE-2005-4033Dec 6, 2005
    Nodezilla
    Nodezilla
    risk 0.00cvss —epss 0.01

    Nodezilla 0.4.13-corno-fulgure does not properly protect the evl_data directory, which could allow them to be shared when they are not protected by PRIVATEDATADIR in nodezilla.ini, which allows remote attackers to obtain sensitive information.

  • CVE-2005-4034Dec 6, 2005
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in Web4Future eDating Professional 5 allow remote attackers to execute arbitrary SQL commands via the (1) s, (2) pg, and (3) sortb parameters to (a) index.php; (4) cid parameter to (b) gift.php and (c) fq.php; and (5) cat parameter to (d)…

  • CVE-2005-4035Dec 6, 2005
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in Web4Future eCommerce Enterprise Edition 2.1 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) prod, and (2) brid parameters to (a) view.php; the (3) the bid parameter to (b) viewbrands.php; and the (4) grp…

  • CVE-2005-4036Dec 6, 2005
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.cgi in Web4Future KeyWord Frequency Counter 1.0 allows remote attackers to inject arbitrary web script or HTML via the "remote URL."

  • CVE-2005-4037Dec 6, 2005
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in functions.php in Web4Future Affiliate Manager PRO 4.1 and earlier allows remote attackers to execute arbitrary SQL commands via the pid parameter.

  • CVE-2005-4038Dec 6, 2005
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in comentarii.php in Web4Future Portal Solutions News Portal allows remote attackers to execute arbitrary SQL commands via the idp parameter.

  • CVE-2005-4039Dec 6, 2005
    Web4Future Portal Solutions
    News Portal
    risk 0.03cvss —epss 0.04

    Directory traversal vulnerability in arhiva.php in Web4Future Portal Solutions News Portal allows remote attackers to read arbitrary files via the dir parameter.

  • CVE-2005-4040Dec 6, 2005
    FileLister
    FileLister
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in FileLister 0.51 and earlier allows remote attackers to execute arbitrary SQL commands via the search parameters, possibly the searchwhat parameter to definesearch.jsp.

  • CVE-2005-4041Dec 6, 2005
    Mrcgiguy
    Hot Links Pro
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in search.cgi in MR CGI Guy Hot Links SQL 3.1.x and Hot Links Pro 3.1.x allows remote attackers to inject arbitrary web script or HTML via the query string.

  • CVE-2005-4042Dec 6, 2005
    Warm Links
    Warm Links
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Warm Links 1.0.0 and earlier allows remote attackers to inject arbitrary web script or HTML via a parameter to search.cgi.

  • CVE-2005-4043Dec 6, 2005
    Hobosworld
    Hobsr
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in view.php in Hobosworld HobSR 1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) arrange and (2) p parameters.

  • CVE-2005-4044Dec 6, 2005
    Mrcgiguy
    Amazon Search Directory
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in search.cgi in Amazon Search Directory 1.0.0 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly the search parameter.

  • CVE-2005-4008Dec 5, 2005
    Jax Calendar
    Jax Calendar
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in jax_calendar.php in Jax Calendar 1.34 allows remote attackers to execute arbitrary SQL commands via the (1) cal_id parameter, and possibly the (2) Y and (3) m parameters.

  • CVE-2005-4009Dec 5, 2005
    PHP Lite
    Calendar Express
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in PHP Lite Calendar Express 2.2 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) cid and (2) catid parameters to (a) day.php, (b) week.php, (c) month.php, and (d) year.php.

  • CVE-2005-4010Dec 5, 2005
    Sensation Designs
    Kbase Express
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in KBase Express 1.0.0 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) id parameter to category.php and (2) search parameters to search.php.

  • CVE-2005-4011Dec 5, 2005
    Codewalkers
    Ltwcalendar
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in calendar.php in Codewalkers ltwCalendar (aka PHP Event Calendar) 4.2, 4.1.3, and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2005-4012Dec 5, 2005
    PHP Web
    Statistik
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in PHP Web Statistik 1.4 allows remote attackers to inject arbitrary web script or HTML via (1) the lastnumber parameter to stat.php and (2) the HTTP referer to pixel.php.

  • CVE-2005-4013Dec 5, 2005
    PHP Web
    Statistik
    risk 0.00cvss —epss 0.02

    PHP Web Statistik 1.4 stores the stat.cfg file under the web root with insufficient access control, which allows remote attackers to obtain sensitive information such as statistics and the log directory location, possibly including the logdb.dta file.

  • CVE-2005-4014Dec 5, 2005
    PHP Web
    Statistik
    risk 0.00cvss —epss 0.02

    stat.php in PHP Web Statistik 1.4 allows remote attackers to cause a denial of service (CPU consumption) via a large lastnumber value.

  • CVE-2005-4015Dec 5, 2005
    PHP Web
    Statistik
    risk 0.00cvss —epss 0.01

    PHP Web Statistik 1.4 does not rotate the log database or limit the size of the referer field, which allows remote attackers to fill the log files via a large number of requests, as demonstrated using pixel.php.

  • CVE-2005-4016Dec 5, 2005
    Widget Press
    Widget Property
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in Widget Property 1.1.19 allows remote attackers to execute arbitrary SQL commands via the (1) property_id, (2) zip_code, (3) property_type_id, (4) price, and (5) city_id parameters to property.php.

  • CVE-2005-4017Dec 5, 2005
    risk 0.00cvss —epss 0.01

    property.php in Widget Property 1.1.19 allows remote attackers to obtain the full server path via an invalid lang value, which leaks the path in the resulting error message.

  • CVE-2005-4018Dec 5, 2005
    Landshop
    Real Estate Commerce System
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in ls.php in Landshop Real Estate Commerce System 0.6.3 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) start, (2) search_order, (3) search_type, (4) search_area, and (5) keyword parameters.

  • CVE-2005-4019Dec 5, 2005
    Vclcomponents
    Relative Real Estate Systems
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in Relative Real Estate Systems 1.02 and earlier allows remote attackers to execute arbitrary SQL commands via the mls parameter.

  • CVE-2005-4020Dec 5, 2005
    Widget Press
    Imprint
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in create.php in Widget Imprint 1.0.26 and earlier allows remote attackers to execute arbitrary SQL commands via the product_id parameter.

  • CVE-2005-4021Dec 5, 2005
    Gallery Project
    Gallery
    risk 0.00cvss —epss 0.01

    The installer for Gallery 2.0 before 2.0.2 stores the install log under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information.

  • CVE-2005-4022Dec 5, 2005
    Gallery Project
    Gallery
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the "Add Image From Web" feature in Gallery 2.0 before 2.0.2 allows remote attackers to inject arbitrary web script or HTML via Javascript in an IMG tag.

  • CVE-2005-4023Dec 5, 2005
    Gallery Project
    Gallery
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the zipcart module in Gallery 2.0 before 2.0.2 allows remote attackers to read arbitrary files via unknown vectors.

  • CVE-2005-4024Dec 5, 2005
    Interspire
    Fastfind
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Interspire FastFind 2004 and 2005 allows remote attackers to inject arbitrary web script or HTML via the query parameter.

  • CVE-2005-4025Dec 5, 2005
    Help Desk Reloaded
    Free Help Desk
    risk 0.00cvss —epss 0.01

    Help Desk Reloaded Free Help Desk does not remove or protect install.php once installation is complete, which allows remote attackers to gain privileges via a direct request to install.php, then navigating to accountsetup.php and creating a new user.

  • CVE-2005-4026Dec 5, 2005
    Geeklog
    Geeklog
    risk 0.00cvss —epss 0.01

    search.php in Geeklog 1.4.x before 1.4.0rc1, and 1.3.x before 1.3.11sr3, allows remote attackers to obtain sensitive information via invalid (1) datestart and (2) dateend parameters, which leaks the web server path in an error message.

  • CVE-2005-4027Dec 5, 2005
    SimpleBBS
    SimpleBBS
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in SimpleBBS 1.1 allows remote attackers to execute arbitrary SQL commands via unspecified search module parameters.

  • CVE-2005-4028Dec 5, 2005
    Amember
    Amember
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in aMember allow remote attackers to inject arbitrary web script or HTML via the (1) lamember_login parameter to sendpass.php and (2) login parameter to member.php.

  • CVE-2005-4029Dec 5, 2005
    Esi Products
    Webeoc
    risk 0.00cvss —epss 0.01

    WebEOC before 6.0.2 allows remote attackers to obtain valid usernames via the HTML source of the WebEOC login webpage, which could be useful in other attacks such as locking out valid users via brute force methods.

  • CVE-2005-4005Dec 5, 2005
    PHP-Fusion
    Phpfusion
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in messages.php in PHP-Fusion 6.00.109 allows remote attackers to obtain path information and possibly execute arbitrary SQL commands via the srch_text parameter in a Search and Sort option to messages.php.

  • CVE-2005-4006Dec 5, 2005
    Redgraphic
    Sapid CMS
    risk 0.00cvss —epss 0.02

    SAPID CMS before 1.2.3.03 allows remote attackers to bypass authentication via direct requests to the usr/system files (1) insert_file.php, (2) insert_image.php, (3) insert_link.php, (4) insert_qcfile.php, and (5) edit.php.

  • CVE-2005-4007Dec 5, 2005
    Redgraphic
    Sapid CMS
    risk 0.00cvss —epss 0.01

    Multiple unspecified vulnerabilities in SAPID CMS before 1.2.3.03, related to newly registered users and possibly authorization checks, have unknown impact and attack vectors involving (1) mvc/controller/user_request_analysis.inc.php and (2) usr/xml/ddc/authorization.xml.

  • CVE-2005-3993Dec 5, 2005
    MailEnable
    Mailenable
    risk 0.00cvss —epss 0.01

    Multiple unspecified vulnerabilities in MailEnable Professional 1.6 and earlier and Enterprise 1.1 and earlier allow attackers to cause a denial of service (crash) via invalid IMAP commands.

  • CVE-2005-3995Dec 5, 2005
    Sobexsrv
    Sobexsrv
    risk 0.03cvss —epss 0.04

    Format string vulnerability in the dosyslog function in the OBEX server (obexsrv.c) for Sobexsrv before 1.0.0-pre4, when the syslog (-S) function is enabled, allows remote attackers to execute arbitrary code via format string specifiers in file name arguments to OBEX commands.

  • CVE-2005-3996Dec 5, 2005
    Zen Cart
    ZenCart
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in admin/password_forgotten.php in Zen Cart 1.2.6d and earlier allows remote attackers to execute arbitrary SQL commands via the admin_email parameter.

  • CVE-2005-3997Dec 5, 2005
    Zen Cart
    ZenCart
    risk 0.00cvss —epss 0.02

    Zen Cart 1.2.6d and earlier, under certain PHP configurations, allows remote attackers to obtain sensitive information via direct requests to files in the admin/includes directory, including (1) graphs/banner_daily.php, (2) graphs/banner_infobox.php, (3)…

  • CVE-2005-3998Dec 5, 2005
    Solupress
    Solupress News
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in search.asp in Solupress News 1.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the keywords parameter.

  • CVE-2005-3999Dec 5, 2005
    Sitebeater
    MP3 Catalog
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Search.asp in SiteBeater MP3 Catalog 2.03 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.

  • CVE-2005-4000Dec 5, 2005
    Sitebeater
    News System
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in archive.asp in SiteBeater News System 4.00 and earlier allows remote attackers to inject arbitrary web script or HTML via the sKeywords parameter.

  • CVE-2005-4001Dec 5, 2005
    Phpyellow
    Phpyellowtm Pro
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in phpYellowTM Pro Edition and Lite Edition 5.33 allow remote attackers to execute arbitrary SQL commands via the (1) haystack parameter to search_result.php or (2) ckey parameter to print_me.php.

  • CVE-2005-4002Dec 5, 2005
    Esi Products
    Webeoc
    risk 0.00cvss —epss 0.01

    WebEOC before 6.0.2 uses the same secret key for all installations, which allows attackers with the key to decrypt data from any WebEOC installation.