VYPR

CVEs

383,899 total · page 7052 of 7,678

AllCriticalHighKEV
  • CVE-2008-3026Jul 7, 2008
    Oneclick CMS
    Oneclick CMS
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in OneClick CMS (aka Sisplet CMS) 2008-01-24 allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2008-3027Jul 7, 2008
    Vangogh Web CMS
    Vangogh Web CMS
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in get_article.php in VanGogh Web CMS 0.9 allows remote attackers to execute arbitrary SQL commands via the article_ID parameter to index.php.

  • CVE-2008-3028Jul 7, 2008
    TYPO3
    Send A Card
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the Send-A-Card (sr_sendcard) extension 2.2.2 and earlier for TYPO3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2008-3029Jul 7, 2008
    TYPO3
    Wec Discussion Forum
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the WEC Discussion Forum (wec_discussion) extension 1.6.2 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2008-3030Jul 7, 2008
    Efestech
    Shop
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in default.asp in EfesTECH Shop 2.0 allows remote attackers to execute arbitrary SQL commands via the cat_id parameter in an urunler action.

  • CVE-2008-3031Jul 7, 2008
    Simple PHP Agenda
    Simple PHP Agenda
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in index.php in Simple PHP Agenda 2.2.4 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the page parameter.

  • CVE-2008-3032Jul 7, 2008
    TYPO3
    phpMyAdmin
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the phpMyAdmin (phpmyadmin) extension 3.0.1 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2008-3033Jul 7, 2008
    Rss Aggregator
    Rss Aggregator
    risk 0.03cvss —epss 0.03

    RSS-aggregator 1.0 does not require administrative authentication for the admin/fonctions/ directory, which allows remote attackers to access admin functions and have unspecified other impact, as demonstrated by (1) an IdFlux request to supprimer_flux.php and (2) a TpsRafraich…

  • CVE-2008-3034Jul 7, 2008
    Rss Aggregator
    Rss Aggregator
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in RSS-aggregator 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) IdFlux parameter to admin/fonctions/supprimer_flux.php and the (2) IdTag parameter to admin/fonctions/supprimer_tag.php.

  • CVE-2008-3035Jul 7, 2008
    Xchangeboard
    Xchangeboard
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in newThread.php in XchangeBoard 1.70 Final and earlier allows remote authenticated users to execute arbitrary SQL commands via the boardID parameter.

  • CVE-2008-3036Jul 7, 2008
    CMS Little
    CMS Little
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in index.php in CMS little 0.0.1 allows remote attackers to include and execute arbitrary local files, and probably remote files, via a .. (dot dot) in the template parameter.

  • CVE-2008-3037Jul 7, 2008
    TYPO3
    Address Directory
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Address Directory (sp_directory) extension 0.2.10 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2008-3038Jul 7, 2008
    TYPO3
    Address Directory
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Address Directory (sp_directory) extension 0.2.10 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2008-3039Jul 7, 2008
    TYPO3
    DAM Frontend
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the DAM Frontend (dam_frontend) extension 0.1.0 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2008-3040Jul 7, 2008
    TYPO3
    DAM Frontend
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the DAM Frontend (dam_frontend) extension 0.1.0 and earlier for TYPO3 allows remote attackers to obtain sensitive information via unknown vectors.

  • CVE-2008-3041Jul 7, 2008
    TYPO3
    DAM Frontend
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the DAM Frontend (dam_frontend) extension 0.1.0 and earlier for TYPO3 has unknown impact and attack vectors related to "broken access control."

  • CVE-2008-3042Jul 7, 2008
    TYPO3
    DAM Frontend
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the DAM Frontend (dam_frontend) extension 0.1.0 and earlier for TYPO3 has unknown impact and attack vectors related to "Improper Error Handling."

  • CVE-2008-3043Jul 7, 2008
    TYPO3
    Wec Discussion Forum
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the WEC Discussion Forum (wec_discussion) extension 1.6.2 and earlier for TYPO3 allows attackers to execute arbitrary code via vectors related to "certain file types."

  • CVE-2008-3044Jul 7, 2008
    TYPO3
    News Calendar
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the News Calendar (newscalendar) extension 1.0.7 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2008-3045Jul 7, 2008
    TYPO3
    Industry Database
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the Industry Database (aka Branchendatenbank pro_industrydb) extension 1.0.0 and earlier for TYPO3 has unknown impact and attack vectors related to "Insufficient Verification of Data Authenticity."

  • CVE-2008-3046Jul 7, 2008
    TYPO3
    Packman
    risk 0.00cvss —epss 0.01

    Incomplete blacklist vulnerability in the Packman (kb_packman) extension 0.2.1 and earlier for TYPO3 has unknown impact and attack vectors.

  • CVE-2008-3047Jul 7, 2008
    TYPO3
    KB Unpack
    risk 0.00cvss —epss 0.01

    Incomplete blacklist vulnerability in the KB Unpack (kb_unpack) extension 0.1.0 and earlier for TYPO3 has unknown impact and attack vectors.

  • CVE-2008-3048Jul 7, 2008
    TYPO3
    pdf_generator2
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the PDF Generator 2 (pdf_generator2) extension 0.5.0 and earlier for TYPO3 has unknown impact and attack vectors related to "Unprotected test functionality."

  • CVE-2008-3049Jul 7, 2008
    TYPO3
    pdf_generator2
    risk 0.00cvss —epss 0.01

    The PDF Generator 2 (pdf_generator2) extension 0.5.0 and earlier for TYPO3 allows attackers to obtain sensitive information via unspecified vectors.

  • CVE-2008-3050Jul 7, 2008
    TYPO3
    pdf_generator2
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the PDF Generator 2 (pdf_generator2) extension 0.5.0 and earlier for TYPO3 allows attackers to cause a denial of service via unspecified vectors.

  • CVE-2008-3051Jul 7, 2008
    TYPO3
    Pinboard Extension
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Pinboard extension 0.0.6 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2008-3052Jul 7, 2008
    TYPO3
    SQL Frontend (mh_omsqlio)
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in the SQL Frontend (mh_omsqlio) extension 1.0.11 and earlier for TYPO3 allows remote attackers to cause a denial of service via unknown vectors.

  • CVE-2008-3053Jul 7, 2008
    TYPO3
    mh_omsqlio
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the SQL Frontend (mh_omsqlio) extension 1.0.11 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2008-3054Jul 7, 2008
    TYPO3
    mh_branchenbuch
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Branchenbuch (aka Yellow Pages o (mh_branchenbuch) extension 0.8.1 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2008-3055Jul 7, 2008
    TYPO3
    Support view
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Support view (ext_tbl) extension 0.0.102 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2008-3056Jul 7, 2008
    TYPO3
    Codeon Petition
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the Codeon Petition (cd_petition) extension 0.0.2 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2008-3022Jul 7, 2008
    Phportal
    Phportal
    risk 0.03cvss —epss 0.02

    Multiple PHP remote file inclusion vulnerabilities in sablonlar/gunaysoft/gunaysoft.php in PHPortal 1.2 Beta allow remote attackers to execute arbitrary PHP code via a URL in (1) icerikyolu, (2) sayfaid, and (3) uzanti parameters.

  • CVE-2008-3023Jul 7, 2008
    Freestyle
    Wiki
    risk 0.01cvss —epss 0.12

    Cross-site scripting (XSS) vulnerability in FreeStyle Wiki 3.6.2 and earlier, and 3.6.3 dev3 and earlier development versions, when Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different issue than…

  • CVE-2008-3024Jul 7, 2008
    QNX
    Rtos
    risk 0.03cvss —epss 0.06

    Stack-based buffer overflow in phgrafx in QNX Momentics (aka RTOS) 6.3.2 and earlier allows local users to gain privileges via a long .pal filename in palette/.

  • CVE-2008-2993Jul 3, 2008
    Fog
    Fog Forum
    risk 0.03cvss —epss 0.02

    Multiple directory traversal vulnerabilities in index.php in FOG Forum 0.8.1 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the (1) fog_lang and (2) fog_skin parameters, probably related to libs/required/share.inc; and possibly the (3)…

  • CVE-2008-2994Jul 3, 2008
    Phpeasydata
    Phpeasydata
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in PHPEasyData 1.5.4 allow remote attackers to inject arbitrary web script or HTML via the (1) annuaire parameter to (a) last_records.php and (b) annuaire.php and the (2) by and (3) cat_id parameters to annuaire.php.

  • CVE-2008-2995Jul 3, 2008
    Phpeasydata
    Phpeasydata
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in PHPEasyData 1.5.4 allow remote attackers to execute arbitrary SQL commands via (1) the annuaire parameter to annuaire.php or (2) the username field in admin/login.php.

  • CVE-2008-2996Jul 3, 2008
    Gravityboardx
    Gravity Board X
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in index.php in Gravity Board X (GBX) 2.0 Beta, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) searchquery parameter in a getsearch action, and the (2) board_id parameter in a…

  • CVE-2008-2997Jul 3, 2008
    Gravityboardx
    Gravity Board X
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in Gravity Board X (GBX) 2.0 Beta allows remote attackers to inject arbitrary web script or HTML via the subject parameter in a postnewsubmit (aka create new thread) action.

  • CVE-2008-2998Jul 3, 2008
    Drupal
    Aggregation Module
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the Aggregation module 5.x before 5.x-4.4 for Drupal allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2008-2999Jul 3, 2008
    Drupal
    Drupal
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in the Aggregation module 5.x before 5.x-4.4 for Drupal allow remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2008-3000Jul 3, 2008
    Drupal
    Aggregation Module
    risk 0.00cvss —epss 0.01

    The Aggregation module 5.x before 5.x-4.4 for Drupal, when node access modules are used, does not properly implement access control, which allows remote attackers to bypass intended restrictions.

  • CVE-2008-3001Jul 3, 2008
    Drupal
    Aggregation Module
    risk 0.00cvss —epss 0.03

    The Aggregation module 5.x before 5.x-4.4 for Drupal allows remote attackers to upload files with arbitrary extensions, and possibly execute arbitrary code, via a crafted feed that allows upload of files with arbitrary extensions.

  • CVE-2008-2959Jul 2, 2008
    Microsoft
    Visual Basic Enterprise Edition
    risk 0.05cvss —epss 0.25

    Buffer overflow in a certain ActiveX control (vb6skit.dll) in Microsoft Visual Basic Enterprise Edition 6.0 SP6 might allow remote attackers to execute arbitrary code via a long lpstrLinkPath argument to the fCreateShellLink function.

  • CVE-2008-2960Jul 2, 2008
    PhpMyAdmin
    phpMyAdmin
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in phpMyAdmin before 2.11.7, when register_globals is enabled and .htaccess support is disabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving scripts in libraries/.

  • CVE-2008-2961Jul 2, 2008
    Cmsmini
    CMS Mini
    risk 0.03cvss —epss 0.03

    Multiple directory traversal vulnerabilities in view/index.php in CMS Mini 0.2.2 allow remote attackers to read arbitrary local files via a .. (dot dot) in the (1) path and (2) p parameter.

  • CVE-2008-2962Jul 2, 2008
    Myblog
    Myblog
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in MyBlog allow remote attackers to inject arbitrary web script or HTML via the (1) s and (2) sort parameters to index.php, and the (3) id parameter to post.php.

  • CVE-2008-2963Jul 2, 2008
    Myblog
    Myblog
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in MyBlog allow remote attackers to execute arbitrary SQL commands via the (1) view parameter to (a) index.php, and the (2) id parameter to (b) member.php and (c) post.php.

  • CVE-2008-2964Jul 2, 2008
    Researchguide
    Researchguide
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in guide.php in ResearchGuide 0.5 allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2008-2965Jul 2, 2008
    Jaxultrabb
    Jaxultrabb
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in viewforum.php in JaxUltraBB (JUBB) 2.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the forum parameter.