CVEs

379,656 total · page 7305 of 7,594

CVE	Vendor / Product	Risk	CVSS	EPSS	Published	Description
CVE-2005-4053	Cowiki Cowiki	0.03	—	0.02	Dec 7, 2005	Cross-site scripting (XSS) vulnerability in coWiki 0.3.4 allows remote attackers to inject arbitrary web script or HTML via the q parameter, as demonstrated using 26.html.
CVE-2005-4054	Pluggedout Blog	0.03	—	0.01	Dec 7, 2005	SQL injection vulnerability in index.php in PluggedOut Blog 1.9.5 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) categoryid, (2) entryid, (3) year, (4) month, and (5) day parameter.
CVE-2005-4055	Cars Portal Cars Portal	0.03	—	0.01	Dec 7, 2005	SQL injection vulnerability in index.php in Cars Portal 1.1 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) page and (2) car parameters.
CVE-2005-4056	Pluggedout Nexus	0.00	—	0.01	Dec 7, 2005	SQL injection vulnerability in search.php in PluggedOut Nexus 0.1 allows remote attackers to execute arbitrary SQL commands via the (1) Location, (2) Last Name, and (3) First Name parameters.
CVE-2005-4057	Pluggedout Nexus	0.00	—	0.01	Dec 7, 2005	Cross-site scripting (XSS) vulnerability in search.php in PluggedOut Nexus 0.1 allows remote attackers to inject arbitrary web script or HTML via the (1) Location, (2) Last Name, and (3) First Name parameters.
CVE-2005-4058	Saralblog Saralblog	0.00	—	0.01	Dec 7, 2005	SQL injection vulnerability in saralblog 1 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter to viewprofile.php.
CVE-2005-4059	Locazo Locazolist	0.00	—	0.01	Dec 7, 2005	SQL injection vulnerability in searchdb.asp in LocazoList 1.03c and earlier allows remote attackers to execute arbitrary SQL commands via the q parameter.
CVE-2005-4060	RwAuction Pro	0.03	—	0.02	Dec 7, 2005	Cross-site scripting (XSS) vulnerability in search.asp in rwAuction Pro 4.0 and 5.0 allows remote attackers to inject arbitrary web script or HTML via the searchtxt parameter.
CVE-2005-4061	—	0.00	—	0.01	Dec 7, 2005	Cross-site scripting (XSS) vulnerability in PASearch.asp in XcPhotoAlbum 1.x allows remote attackers to inject arbitrary web script or HTML via the search parameters.
CVE-2005-4062	XcClassified XcClassified	0.00	—	0.01	Dec 7, 2005	Cross-site scripting (XSS) vulnerability in CPSearch.asp in XcClassified 3.x allows remote attackers to inject arbitrary web script or HTML via the search parameters.
CVE-2005-4063	Netauctionhelp Netauctionhelp	0.03	—	0.02	Dec 7, 2005	Multiple cross-site scripting (XSS) vulnerabilities in NetAuctionHelp 3.0 and earlier allow remote attackers to inject arbitrary HTML and web script via the (1) L, (2) sort, (3) category, (4) categoryname parameters to search.asp.
CVE-2005-4064	A FAQ A-FAQ	0.03	—	0.01	Dec 7, 2005	Multiple SQL injection vulnerabilities in A-FAQ 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) faqid parameter to faqDspItem.asp and (2) catcode parameter to faqDsp.asp.
CVE-2005-4065	Edgewall Software Trac	0.03	—	0.04	Dec 7, 2005	SQL injection vulnerability in the search module in Edgewall Trac before 0.9.2 allows remote attackers to execute arbitrary SQL commands via unknown vectors.
CVE-2005-4066	Ghisler Total Commander	0.00	—	0.00	Dec 7, 2005	Total Commander 6.53 uses weak encryption to store FTP usernames and passwords in WCX_FTP.INI, which allows local users to decrypt the passwords and gain access to FTP servers, as possibly demonstrated by the W32.Gudeb worm.
CVE-2005-2923	Ipswitch, Inc. Ipswitch Collaboration Suite	0.01	—	0.11	Dec 7, 2005	The IMAP server in IMail Server 8.20 in Ipswitch Collaboration Suite (ICS) before 2.02 allows remote attackers to cause a denial of service (crash) via a long argument to the LIST command, which causes IMail Server to reference invalid memory.
CVE-2005-2931	Ipswitch, Inc. Ipswitch Collaboration Suite	0.00	—	0.05	Dec 7, 2005	Format string vulnerability in the SMTP service in IMail Server 8.20 in Ipswitch Collaboration Suite (ICS) before 2.02 allows remote attackers to execute arbitrary code via format string specifiers to the (1) EXPN, (2) MAIL, (3) MAIL FROM, and (4) RCPT TO commands.
CVE-2005-3191	Xpdf Xpdf	0.00	—	0.04	Dec 7, 2005	Multiple heap-based buffer overflows in the (1) DCTStream::readProgressiveSOF and (2) DCTStream::readBaselineSOF functions in the DCT stream parsing code (Stream.cc) in xpdf 3.01 and earlier, as used in products such as (a) Poppler, (b) teTeX, (c) KDE kpdf, (d) pdftohtml, (e)…
CVE-2005-3193	Xpdf Xpdf	0.00	—	0.04	Dec 7, 2005	Heap-based buffer overflow in the JPXStream::readCodestream function in the JPX stream parsing code (JPXStream.c) for xpdf 3.01 and earlier, as used in products such as (1) Poppler, (2) teTeX, (3) KDE kpdf, (4) CUPS, and (5) libextractor allows user-assisted attackers to cause a…
CVE-2005-4030	Quicksilver Forums Quicksilver Forums	0.00	—	0.01	Dec 6, 2005	SQL injection vulnerability in Quicksilver Forums before 1.5.1 allows remote attackers to execute arbitrary SQL commands via the HTTP_USER_AGENT header.
CVE-2005-4031	MediaWiki Mediawiki	0.00	—	0.03	Dec 6, 2005	Eval injection vulnerability in MediaWiki 1.5.x before 1.5.3 allows remote attackers to execute arbitrary PHP code via the "user language option," which is used as part of a dynamic class name that is processed using the eval function.
CVE-2005-4032	—	0.03	—	0.02	Dec 6, 2005	Cross-site scripting (XSS) vulnerability in search.cgi in Easy Search System 1.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the q parameter.
CVE-2005-4033	Nodezilla Nodezilla	0.00	—	0.01	Dec 6, 2005	Nodezilla 0.4.13-corno-fulgure does not properly protect the evl_data directory, which could allow them to be shared when they are not protected by PRIVATEDATADIR in nodezilla.ini, which allows remote attackers to obtain sensitive information.
CVE-2005-4034	—	0.03	—	0.02	Dec 6, 2005	Multiple SQL injection vulnerabilities in Web4Future eDating Professional 5 allow remote attackers to execute arbitrary SQL commands via the (1) s, (2) pg, and (3) sortb parameters to (a) index.php; (4) cid parameter to (b) gift.php and (c) fq.php; and (5) cat parameter to (d)…
CVE-2005-4035	—	0.03	—	0.01	Dec 6, 2005	Multiple SQL injection vulnerabilities in Web4Future eCommerce Enterprise Edition 2.1 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) prod, and (2) brid parameters to (a) view.php; the (3) the bid parameter to (b) viewbrands.php; and the (4) grp…
CVE-2005-4036	—	0.00	—	0.01	Dec 6, 2005	Cross-site scripting (XSS) vulnerability in index.cgi in Web4Future KeyWord Frequency Counter 1.0 allows remote attackers to inject arbitrary web script or HTML via the "remote URL."
CVE-2005-4037	—	0.03	—	0.01	Dec 6, 2005	SQL injection vulnerability in functions.php in Web4Future Affiliate Manager PRO 4.1 and earlier allows remote attackers to execute arbitrary SQL commands via the pid parameter.
CVE-2005-4038	—	0.00	—	0.01	Dec 6, 2005	SQL injection vulnerability in comentarii.php in Web4Future Portal Solutions News Portal allows remote attackers to execute arbitrary SQL commands via the idp parameter.
CVE-2005-4039	Web4Future Portal Solutions News Portal	0.03	—	0.04	Dec 6, 2005	Directory traversal vulnerability in arhiva.php in Web4Future Portal Solutions News Portal allows remote attackers to read arbitrary files via the dir parameter.
CVE-2005-4040	FileLister FileLister	0.00	—	0.01	Dec 6, 2005	SQL injection vulnerability in FileLister 0.51 and earlier allows remote attackers to execute arbitrary SQL commands via the search parameters, possibly the searchwhat parameter to definesearch.jsp.
CVE-2005-4041	Mrcgiguy Hot Links Pro	0.00	—	0.01	Dec 6, 2005	Cross-site scripting (XSS) vulnerability in search.cgi in MR CGI Guy Hot Links SQL 3.1.x and Hot Links Pro 3.1.x allows remote attackers to inject arbitrary web script or HTML via the query string.
CVE-2005-4042	Warm Links Warm Links	0.00	—	0.01	Dec 6, 2005	Cross-site scripting (XSS) vulnerability in Warm Links 1.0.0 and earlier allows remote attackers to inject arbitrary web script or HTML via a parameter to search.cgi.
CVE-2005-4043	Hobosworld Hobsr	0.03	—	0.01	Dec 6, 2005	SQL injection vulnerability in view.php in Hobosworld HobSR 1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) arrange and (2) p parameters.
CVE-2005-4044	Mrcgiguy Amazon Search Directory	0.00	—	0.01	Dec 6, 2005	Cross-site scripting (XSS) vulnerability in search.cgi in Amazon Search Directory 1.0.0 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly the search parameter.
CVE-2005-4008	Jax Calendar Jax Calendar	0.00	—	0.01	Dec 5, 2005	SQL injection vulnerability in jax_calendar.php in Jax Calendar 1.34 allows remote attackers to execute arbitrary SQL commands via the (1) cal_id parameter, and possibly the (2) Y and (3) m parameters.
CVE-2005-4009	PHP Lite Calendar Express	0.00	—	0.01	Dec 5, 2005	Multiple SQL injection vulnerabilities in PHP Lite Calendar Express 2.2 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) cid and (2) catid parameters to (a) day.php, (b) week.php, (c) month.php, and (d) year.php.
CVE-2005-4010	Sensation Designs Kbase Express	0.00	—	0.01	Dec 5, 2005	SQL injection vulnerability in KBase Express 1.0.0 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) id parameter to category.php and (2) search parameters to search.php.
CVE-2005-4011	Codewalkers Ltwcalendar	0.03	—	0.02	Dec 5, 2005	SQL injection vulnerability in calendar.php in Codewalkers ltwCalendar (aka PHP Event Calendar) 4.2, 4.1.3, and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVE-2005-4012	PHP Web Statistik	0.00	—	0.02	Dec 5, 2005	Multiple cross-site scripting (XSS) vulnerabilities in PHP Web Statistik 1.4 allows remote attackers to inject arbitrary web script or HTML via (1) the lastnumber parameter to stat.php and (2) the HTTP referer to pixel.php.
CVE-2005-4013	PHP Web Statistik	0.00	—	0.02	Dec 5, 2005	PHP Web Statistik 1.4 stores the stat.cfg file under the web root with insufficient access control, which allows remote attackers to obtain sensitive information such as statistics and the log directory location, possibly including the logdb.dta file.
CVE-2005-4014	PHP Web Statistik	0.00	—	0.02	Dec 5, 2005	stat.php in PHP Web Statistik 1.4 allows remote attackers to cause a denial of service (CPU consumption) via a large lastnumber value.
CVE-2005-4015	PHP Web Statistik	0.00	—	0.01	Dec 5, 2005	PHP Web Statistik 1.4 does not rotate the log database or limit the size of the referer field, which allows remote attackers to fill the log files via a large number of requests, as demonstrated using pixel.php.
CVE-2005-4016	Widget Press Widget Property	0.03	—	0.01	Dec 5, 2005	SQL injection vulnerability in Widget Property 1.1.19 allows remote attackers to execute arbitrary SQL commands via the (1) property_id, (2) zip_code, (3) property_type_id, (4) price, and (5) city_id parameters to property.php.
CVE-2005-4017	—	0.00	—	0.01	Dec 5, 2005	property.php in Widget Property 1.1.19 allows remote attackers to obtain the full server path via an invalid lang value, which leaks the path in the resulting error message.
CVE-2005-4018	Landshop Real Estate Commerce System	0.03	—	0.01	Dec 5, 2005	SQL injection vulnerability in ls.php in Landshop Real Estate Commerce System 0.6.3 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) start, (2) search_order, (3) search_type, (4) search_area, and (5) keyword parameters.
CVE-2005-4019	Vclcomponents Relative Real Estate Systems	0.03	—	0.01	Dec 5, 2005	SQL injection vulnerability in index.php in Relative Real Estate Systems 1.02 and earlier allows remote attackers to execute arbitrary SQL commands via the mls parameter.
CVE-2005-4020	Widget Press Imprint	0.00	—	0.01	Dec 5, 2005	SQL injection vulnerability in create.php in Widget Imprint 1.0.26 and earlier allows remote attackers to execute arbitrary SQL commands via the product_id parameter.
CVE-2005-4021	Gallery Project Gallery	0.00	—	0.01	Dec 5, 2005	The installer for Gallery 2.0 before 2.0.2 stores the install log under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information.
CVE-2005-4022	Gallery Project Gallery	0.00	—	0.01	Dec 5, 2005	Cross-site scripting (XSS) vulnerability in the "Add Image From Web" feature in Gallery 2.0 before 2.0.2 allows remote attackers to inject arbitrary web script or HTML via Javascript in an IMG tag.
CVE-2005-4023	Gallery Project Gallery	0.00	—	0.01	Dec 5, 2005	Unspecified vulnerability in the zipcart module in Gallery 2.0 before 2.0.2 allows remote attackers to read arbitrary files via unknown vectors.
CVE-2005-4024	Interspire Fastfind	0.00	—	0.01	Dec 5, 2005	Cross-site scripting (XSS) vulnerability in Interspire FastFind 2004 and 2005 allows remote attackers to inject arbitrary web script or HTML via the query parameter.

CVE-2005-4053Dec 7, 2005
Cowiki
Cowiki
risk 0.03cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in coWiki 0.3.4 allows remote attackers to inject arbitrary web script or HTML via the q parameter, as demonstrated using 26.html.
CVE-2005-4054Dec 7, 2005
Pluggedout
Blog
risk 0.03cvss —epss 0.01
SQL injection vulnerability in index.php in PluggedOut Blog 1.9.5 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) categoryid, (2) entryid, (3) year, (4) month, and (5) day parameter.
CVE-2005-4055Dec 7, 2005
Cars Portal
Cars Portal
risk 0.03cvss —epss 0.01
SQL injection vulnerability in index.php in Cars Portal 1.1 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) page and (2) car parameters.
CVE-2005-4056Dec 7, 2005
Pluggedout
Nexus
risk 0.00cvss —epss 0.01
SQL injection vulnerability in search.php in PluggedOut Nexus 0.1 allows remote attackers to execute arbitrary SQL commands via the (1) Location, (2) Last Name, and (3) First Name parameters.
CVE-2005-4057Dec 7, 2005
Pluggedout
Nexus
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in search.php in PluggedOut Nexus 0.1 allows remote attackers to inject arbitrary web script or HTML via the (1) Location, (2) Last Name, and (3) First Name parameters.
CVE-2005-4058Dec 7, 2005
Saralblog
Saralblog
risk 0.00cvss —epss 0.01
SQL injection vulnerability in saralblog 1 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter to viewprofile.php.
CVE-2005-4059Dec 7, 2005
Locazo
Locazolist
risk 0.00cvss —epss 0.01
SQL injection vulnerability in searchdb.asp in LocazoList 1.03c and earlier allows remote attackers to execute arbitrary SQL commands via the q parameter.
CVE-2005-4060Dec 7, 2005
RwAuction
Pro
risk 0.03cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in search.asp in rwAuction Pro 4.0 and 5.0 allows remote attackers to inject arbitrary web script or HTML via the searchtxt parameter.
CVE-2005-4061Dec 7, 2005
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in PASearch.asp in XcPhotoAlbum 1.x allows remote attackers to inject arbitrary web script or HTML via the search parameters.
CVE-2005-4062Dec 7, 2005
XcClassified
XcClassified
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in CPSearch.asp in XcClassified 3.x allows remote attackers to inject arbitrary web script or HTML via the search parameters.
CVE-2005-4063Dec 7, 2005
Netauctionhelp
Netauctionhelp
risk 0.03cvss —epss 0.02
Multiple cross-site scripting (XSS) vulnerabilities in NetAuctionHelp 3.0 and earlier allow remote attackers to inject arbitrary HTML and web script via the (1) L, (2) sort, (3) category, (4) categoryname parameters to search.asp.
CVE-2005-4064Dec 7, 2005
A FAQ
A-FAQ
risk 0.03cvss —epss 0.01
Multiple SQL injection vulnerabilities in A-FAQ 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) faqid parameter to faqDspItem.asp and (2) catcode parameter to faqDsp.asp.
CVE-2005-4065Dec 7, 2005
Edgewall Software
Trac
risk 0.03cvss —epss 0.04
SQL injection vulnerability in the search module in Edgewall Trac before 0.9.2 allows remote attackers to execute arbitrary SQL commands via unknown vectors.
CVE-2005-4066Dec 7, 2005
Ghisler
Total Commander
risk 0.00cvss —epss 0.00
Total Commander 6.53 uses weak encryption to store FTP usernames and passwords in WCX_FTP.INI, which allows local users to decrypt the passwords and gain access to FTP servers, as possibly demonstrated by the W32.Gudeb worm.
CVE-2005-2923Dec 7, 2005
Ipswitch, Inc.
Ipswitch Collaboration Suite
risk 0.01cvss —epss 0.11
The IMAP server in IMail Server 8.20 in Ipswitch Collaboration Suite (ICS) before 2.02 allows remote attackers to cause a denial of service (crash) via a long argument to the LIST command, which causes IMail Server to reference invalid memory.
CVE-2005-2931Dec 7, 2005
Ipswitch, Inc.
Ipswitch Collaboration Suite
risk 0.00cvss —epss 0.05
Format string vulnerability in the SMTP service in IMail Server 8.20 in Ipswitch Collaboration Suite (ICS) before 2.02 allows remote attackers to execute arbitrary code via format string specifiers to the (1) EXPN, (2) MAIL, (3) MAIL FROM, and (4) RCPT TO commands.
CVE-2005-3191Dec 7, 2005
Xpdf
Xpdf
risk 0.00cvss —epss 0.04
Multiple heap-based buffer overflows in the (1) DCTStream::readProgressiveSOF and (2) DCTStream::readBaselineSOF functions in the DCT stream parsing code (Stream.cc) in xpdf 3.01 and earlier, as used in products such as (a) Poppler, (b) teTeX, (c) KDE kpdf, (d) pdftohtml, (e)…
CVE-2005-3193Dec 7, 2005
Xpdf
Xpdf
risk 0.00cvss —epss 0.04
Heap-based buffer overflow in the JPXStream::readCodestream function in the JPX stream parsing code (JPXStream.c) for xpdf 3.01 and earlier, as used in products such as (1) Poppler, (2) teTeX, (3) KDE kpdf, (4) CUPS, and (5) libextractor allows user-assisted attackers to cause a…
CVE-2005-4030Dec 6, 2005
Quicksilver Forums
Quicksilver Forums
risk 0.00cvss —epss 0.01
SQL injection vulnerability in Quicksilver Forums before 1.5.1 allows remote attackers to execute arbitrary SQL commands via the HTTP_USER_AGENT header.
CVE-2005-4031Dec 6, 2005
MediaWiki
Mediawiki
risk 0.00cvss —epss 0.03
Eval injection vulnerability in MediaWiki 1.5.x before 1.5.3 allows remote attackers to execute arbitrary PHP code via the "user language option," which is used as part of a dynamic class name that is processed using the eval function.
CVE-2005-4032Dec 6, 2005
risk 0.03cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in search.cgi in Easy Search System 1.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the q parameter.
CVE-2005-4033Dec 6, 2005
Nodezilla
Nodezilla
risk 0.00cvss —epss 0.01
Nodezilla 0.4.13-corno-fulgure does not properly protect the evl_data directory, which could allow them to be shared when they are not protected by PRIVATEDATADIR in nodezilla.ini, which allows remote attackers to obtain sensitive information.
CVE-2005-4034Dec 6, 2005
risk 0.03cvss —epss 0.02
Multiple SQL injection vulnerabilities in Web4Future eDating Professional 5 allow remote attackers to execute arbitrary SQL commands via the (1) s, (2) pg, and (3) sortb parameters to (a) index.php; (4) cid parameter to (b) gift.php and (c) fq.php; and (5) cat parameter to (d)…
CVE-2005-4035Dec 6, 2005
risk 0.03cvss —epss 0.01
Multiple SQL injection vulnerabilities in Web4Future eCommerce Enterprise Edition 2.1 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) prod, and (2) brid parameters to (a) view.php; the (3) the bid parameter to (b) viewbrands.php; and the (4) grp…
CVE-2005-4036Dec 6, 2005
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in index.cgi in Web4Future KeyWord Frequency Counter 1.0 allows remote attackers to inject arbitrary web script or HTML via the "remote URL."
CVE-2005-4037Dec 6, 2005
risk 0.03cvss —epss 0.01
SQL injection vulnerability in functions.php in Web4Future Affiliate Manager PRO 4.1 and earlier allows remote attackers to execute arbitrary SQL commands via the pid parameter.
CVE-2005-4038Dec 6, 2005
risk 0.00cvss —epss 0.01
SQL injection vulnerability in comentarii.php in Web4Future Portal Solutions News Portal allows remote attackers to execute arbitrary SQL commands via the idp parameter.
CVE-2005-4039Dec 6, 2005
Web4Future Portal Solutions
News Portal
risk 0.03cvss —epss 0.04
Directory traversal vulnerability in arhiva.php in Web4Future Portal Solutions News Portal allows remote attackers to read arbitrary files via the dir parameter.
CVE-2005-4040Dec 6, 2005
FileLister
FileLister
risk 0.00cvss —epss 0.01
SQL injection vulnerability in FileLister 0.51 and earlier allows remote attackers to execute arbitrary SQL commands via the search parameters, possibly the searchwhat parameter to definesearch.jsp.
CVE-2005-4041Dec 6, 2005
Mrcgiguy
Hot Links Pro
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in search.cgi in MR CGI Guy Hot Links SQL 3.1.x and Hot Links Pro 3.1.x allows remote attackers to inject arbitrary web script or HTML via the query string.
CVE-2005-4042Dec 6, 2005
Warm Links
Warm Links
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in Warm Links 1.0.0 and earlier allows remote attackers to inject arbitrary web script or HTML via a parameter to search.cgi.
CVE-2005-4043Dec 6, 2005
Hobosworld
Hobsr
risk 0.03cvss —epss 0.01
SQL injection vulnerability in view.php in Hobosworld HobSR 1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) arrange and (2) p parameters.
CVE-2005-4044Dec 6, 2005
Mrcgiguy
Amazon Search Directory
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in search.cgi in Amazon Search Directory 1.0.0 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly the search parameter.
CVE-2005-4008Dec 5, 2005
Jax Calendar
Jax Calendar
risk 0.00cvss —epss 0.01
SQL injection vulnerability in jax_calendar.php in Jax Calendar 1.34 allows remote attackers to execute arbitrary SQL commands via the (1) cal_id parameter, and possibly the (2) Y and (3) m parameters.
CVE-2005-4009Dec 5, 2005
PHP Lite
Calendar Express
risk 0.00cvss —epss 0.01
Multiple SQL injection vulnerabilities in PHP Lite Calendar Express 2.2 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) cid and (2) catid parameters to (a) day.php, (b) week.php, (c) month.php, and (d) year.php.
CVE-2005-4010Dec 5, 2005
Sensation Designs
Kbase Express
risk 0.00cvss —epss 0.01
SQL injection vulnerability in KBase Express 1.0.0 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) id parameter to category.php and (2) search parameters to search.php.
CVE-2005-4011Dec 5, 2005
Codewalkers
Ltwcalendar
risk 0.03cvss —epss 0.02
SQL injection vulnerability in calendar.php in Codewalkers ltwCalendar (aka PHP Event Calendar) 4.2, 4.1.3, and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVE-2005-4012Dec 5, 2005
PHP Web
Statistik
risk 0.00cvss —epss 0.02
Multiple cross-site scripting (XSS) vulnerabilities in PHP Web Statistik 1.4 allows remote attackers to inject arbitrary web script or HTML via (1) the lastnumber parameter to stat.php and (2) the HTTP referer to pixel.php.
CVE-2005-4013Dec 5, 2005
PHP Web
Statistik
risk 0.00cvss —epss 0.02
PHP Web Statistik 1.4 stores the stat.cfg file under the web root with insufficient access control, which allows remote attackers to obtain sensitive information such as statistics and the log directory location, possibly including the logdb.dta file.
CVE-2005-4014Dec 5, 2005
PHP Web
Statistik
risk 0.00cvss —epss 0.02
stat.php in PHP Web Statistik 1.4 allows remote attackers to cause a denial of service (CPU consumption) via a large lastnumber value.
CVE-2005-4015Dec 5, 2005
PHP Web
Statistik
risk 0.00cvss —epss 0.01
PHP Web Statistik 1.4 does not rotate the log database or limit the size of the referer field, which allows remote attackers to fill the log files via a large number of requests, as demonstrated using pixel.php.
CVE-2005-4016Dec 5, 2005
Widget Press
Widget Property
risk 0.03cvss —epss 0.01
SQL injection vulnerability in Widget Property 1.1.19 allows remote attackers to execute arbitrary SQL commands via the (1) property_id, (2) zip_code, (3) property_type_id, (4) price, and (5) city_id parameters to property.php.
CVE-2005-4017Dec 5, 2005
risk 0.00cvss —epss 0.01
property.php in Widget Property 1.1.19 allows remote attackers to obtain the full server path via an invalid lang value, which leaks the path in the resulting error message.
CVE-2005-4018Dec 5, 2005
Landshop
Real Estate Commerce System
risk 0.03cvss —epss 0.01
SQL injection vulnerability in ls.php in Landshop Real Estate Commerce System 0.6.3 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) start, (2) search_order, (3) search_type, (4) search_area, and (5) keyword parameters.
CVE-2005-4019Dec 5, 2005
Vclcomponents
Relative Real Estate Systems
risk 0.03cvss —epss 0.01
SQL injection vulnerability in index.php in Relative Real Estate Systems 1.02 and earlier allows remote attackers to execute arbitrary SQL commands via the mls parameter.
CVE-2005-4020Dec 5, 2005
Widget Press
Imprint
risk 0.00cvss —epss 0.01
SQL injection vulnerability in create.php in Widget Imprint 1.0.26 and earlier allows remote attackers to execute arbitrary SQL commands via the product_id parameter.
CVE-2005-4021Dec 5, 2005
Gallery Project
Gallery
risk 0.00cvss —epss 0.01
The installer for Gallery 2.0 before 2.0.2 stores the install log under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information.
CVE-2005-4022Dec 5, 2005
Gallery Project
Gallery
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in the "Add Image From Web" feature in Gallery 2.0 before 2.0.2 allows remote attackers to inject arbitrary web script or HTML via Javascript in an IMG tag.
CVE-2005-4023Dec 5, 2005
Gallery Project
Gallery
risk 0.00cvss —epss 0.01
Unspecified vulnerability in the zipcart module in Gallery 2.0 before 2.0.2 allows remote attackers to read arbitrary files via unknown vectors.
CVE-2005-4024Dec 5, 2005
Interspire
Fastfind
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in Interspire FastFind 2004 and 2005 allows remote attackers to inject arbitrary web script or HTML via the query parameter.