Vendor CVEs

Vastal

All CVEs

31 total · sorted by risk

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2018-6367	Vastal Buddy Zone Facebook Clone	Cri	0.67	9.8	0.03	Jan 29, 2018	SQL Injection exists in Vastal I-Tech Buddy Zone Facebook Clone 2.9.9 via the /chat_im/chat_window.php request_id parameter or the /search_events.php category parameter.
CVE-2017-15991	Vastal Agent Zone	Cri	0.67	9.8	0.03	Oct 31, 2017	Vastal I-Tech Agent Zone (aka The Real Estate Script) allows SQL Injection in searchCommercial.php via the property_type, city, or posted_by parameter, or searchResidential.php via the property_type, city, or bedroom parameter, a different vulnerability than CVE-2008-3951,…
CVE-2017-15975	Vastal Dating Zone	Cri	0.67	9.8	0.03	Oct 29, 2017	Vastal I-Tech Dating Zone 0.9.9 allows SQL Injection via the 'product_id' to add_to_cart.php, a different vulnerability than CVE-2008-4461.
CVE-2013-5312	Vastal Phpvid		0.03	—	0.03	Aug 19, 2013	Multiple cross-site scripting (XSS) vulnerabilities in Vastal I-Tech phpVID 1.2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) n parameter to browse_videos.php or the (2) cat parameter to groups.php.
CVE-2013-5311	Vastal Phpvid		0.03	—	0.02	Aug 19, 2013	Multiple SQL injection vulnerabilities in Vastal I-Tech phpVID 1.2.3 allow remote attackers to execute arbitrary SQL commands via the "n" parameter to (1) browse_videos.php or (2) members.php. NOTE: the cat parameter is already covered by CVE-2008-4157.
CVE-2012-6526	Vastal Freelance Zone		0.03	—	0.01	Jan 31, 2013	SQL injection vulnerability in show_code.php in Vastal I-Tech Freelance Zone allows remote attackers to execute arbitrary SQL commands via the code_id parameter.
CVE-2012-0982	Vastal Agent Zone		0.03	—	0.01	Feb 2, 2012	SQL injection vulnerability in search.php in Vastal I-Tech Agent Zone (aka The Real Estate Script) allows remote attackers to execute arbitrary SQL commands via the price_from parameter.
CVE-2009-3496	Vastal Dvd Zone		0.03	—	0.01	Sep 30, 2009	Cross-site scripting (XSS) vulnerability in view_mag.php in Vastal I-Tech DVD Zone allows remote attackers to inject arbitrary web script or HTML via the mag_id parameter.
CVE-2009-3495	Vastal Dvd Zone		0.03	—	0.01	Sep 30, 2009	SQL injection vulnerability in view_mag.php in Vastal I-Tech DVD Zone allows remote attackers to execute arbitrary SQL commands via the mag_id parameter, a different vector than CVE-2008-4465.
CVE-2008-6209	Vastal Software Zone		0.03	—	0.01	Feb 20, 2009	SQL injection vulnerability in view_product.php in Vastal I-Tech Software Zone allows remote attackers to execute arbitrary SQL commands via the cat_id parameter.
CVE-2008-4469	Vastal Freelance Zone		0.03	—	0.01	Oct 7, 2008	SQL injection vulnerability in view_cresume.php in Vastal I-Tech Freelance Zone allows remote attackers to execute arbitrary SQL commands via the coder_id parameter.
CVE-2008-4468	Vastal Share Zone		0.03	—	0.01	Oct 7, 2008	SQL injection vulnerability in view_news.php in Vastal I-Tech Share Zone allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVE-2008-4467	Vastal Toner Cart		0.03	—	0.01	Oct 7, 2008	SQL injection vulnerability in show_series_ink.php in Vastal I-Tech Toner Cart allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVE-2008-4466	Vastal Cosmetics Zone		0.03	—	0.01	Oct 7, 2008	SQL injection vulnerability in view_products_cat.php in Vastal I-Tech Cosmetics Zone allows remote attackers to execute arbitrary SQL commands via the cat_id parameter.
CVE-2008-4465	Vastal Dvd Zone		0.03	—	0.01	Oct 7, 2008	SQL injection vulnerability in view_mags.php in Vastal I-Tech DVD Zone allows remote attackers to execute arbitrary SQL commands via the cat_id parameter.
CVE-2008-4464	Vastal Mag Zone		0.03	—	0.01	Oct 7, 2008	SQL injection vulnerability in view_mags.php in Vastal I-Tech Mag Zone allows remote attackers to execute arbitrary SQL commands via the cat_id parameter.
CVE-2008-4463	Vastal Jobs Zone		0.03	—	0.01	Oct 7, 2008	SQL injection vulnerability in view_news.php in Vastal I-Tech Jobs Zone allows remote attackers to execute arbitrary SQL commands via the news_id parameter.
CVE-2008-4462	Vastal Visa Zone		0.03	—	0.01	Oct 7, 2008	SQL injection vulnerability in view_news.php in Vastal I-Tech Visa Zone allows remote attackers to execute arbitrary SQL commands via the news_id parameter.
CVE-2008-4461	Vastal Dating Zone		0.03	—	0.01	Oct 7, 2008	SQL injection vulnerability in advanced_search_results.php in Vastal I-Tech Dating Zone, possibly 0.9.9, allows remote attackers to execute arbitrary SQL commands via the fage parameter.
CVE-2008-4460	Vastal Mmorpg Zone		0.03	—	0.01	Oct 7, 2008	SQL injection vulnerability in game.php in Vastal I-Tech MMORPG Zone allows remote attackers to execute arbitrary SQL commands via the game_id parameter.
CVE-2008-4157	Vastal Phpvid		0.03	—	0.06	Sep 22, 2008	SQL injection vulnerability in groups.php in Vastal I-Tech phpVID 1.1 allows remote attackers to execute arbitrary SQL commands via the cat parameter, a different vector than CVE-2007-3610. NOTE: it was later reported that 1.2.3 is also affected.
CVE-2008-3953	Vastal Shaadi Zone		0.03	—	0.01	Sep 11, 2008	SQL injection vulnerability in keyword_search_action.php in Vastal I-Tech Shaadi Zone 1.0.9 allows remote attackers to execute arbitrary SQL commands via the tage parameter.
CVE-2008-3951	Vastal Agent Zone		0.03	—	0.01	Sep 11, 2008	SQL injection vulnerability in view_ann.php in Vastal I-Tech Agent Zone (aka The Real Estate Script) allows remote attackers to execute arbitrary SQL commands via the ann_id parameter.
CVE-2008-2335	Vastal Phpvid		0.03	—	0.04	May 19, 2008	Cross-site scripting (XSS) vulnerability in search_results.php in Vastal I-Tech phpVID 1.1 and 1.2 allows remote attackers to inject arbitrary web script or HTML via the query parameter. NOTE: some of these details are obtained from third party information. NOTE: it was later…
CVE-2007-3610	Vastal Phpvid		0.03	—	0.01	Jul 6, 2007	SQL injection vulnerability in categories_type.php in phpVID 0.9.9 allows remote attackers to execute arbitrary SQL commands via the cat parameter.
CVE-2007-3549	Buddy Zone Buddy Zone		0.03	—	0.01	Jul 3, 2007	SQL injection vulnerability in view_sub_cat.php in Buddy Zone 1.5 allows remote attackers to execute arbitrary SQL commands via the cat_id parameter.
CVE-2007-3526	Vastal Buddy Zone		0.03	—	0.02	Jul 3, 2007	Multiple SQL injection vulnerabilities in Buddy Zone 1.5 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the news_id parameter to view_news.php, (2) the cat_id parameter to view_events.php, or (3) the member_id parameter to video_gallery.php.
CVE-2015-2563	Vastal Phpvid		0.00	—	0.02	Mar 20, 2015	SQL injection vulnerability in groups.php in Vastal I-Tech phpVID 0.9.9 and 1.2.3 allows remote attackers to execute arbitrary SQL commands via the order_by parameter. NOTE: The cat parameter vector is already covered by CVE-2008-4157.
CVE-2009-3505	Vastal Mmorpg Zone		0.00	—	0.01	Sep 30, 2009	SQL injection vulnerability in view_news.php in Vastal I-Tech MMORPG Zone allows remote attackers to execute arbitrary SQL commands via the news_id parameter. NOTE: the game_id vector is already covered by CVE-2008-4460.
CVE-2009-3497	Vastal Agent Zone		0.00	—	0.01	Sep 30, 2009	SQL injection vulnerability in view_listing.php in Vastal I-Tech Agent Zone (aka The Real Estate Script) allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVE-2006-3494	Vastal Buddy Zone		0.00	—	0.03	Jul 10, 2006	Multiple cross-site scripting (XSS) vulnerabilities in Buddy Zone 1.0.1 allow remote attackers to inject arbitrary HTML and web script via the (1) cat_id parameter to (a) view_classifieds.php; (2) id parameter in (b) view_ad.php; (3) event_id parameter in (c) view_event.php, (d)…

CVE-2018-6367CriJan 29, 2018
Vastal
Buddy Zone Facebook Clone
risk 0.67cvss 9.8epss 0.03
SQL Injection exists in Vastal I-Tech Buddy Zone Facebook Clone 2.9.9 via the /chat_im/chat_window.php request_id parameter or the /search_events.php category parameter.
CVE-2017-15991CriOct 31, 2017
Vastal
Agent Zone
risk 0.67cvss 9.8epss 0.03
Vastal I-Tech Agent Zone (aka The Real Estate Script) allows SQL Injection in searchCommercial.php via the property_type, city, or posted_by parameter, or searchResidential.php via the property_type, city, or bedroom parameter, a different vulnerability than CVE-2008-3951,…
CVE-2017-15975CriOct 29, 2017
Vastal
Dating Zone
risk 0.67cvss 9.8epss 0.03
Vastal I-Tech Dating Zone 0.9.9 allows SQL Injection via the 'product_id' to add_to_cart.php, a different vulnerability than CVE-2008-4461.
CVE-2013-5312Aug 19, 2013
Vastal
Phpvid
risk 0.03cvss —epss 0.03
Multiple cross-site scripting (XSS) vulnerabilities in Vastal I-Tech phpVID 1.2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) n parameter to browse_videos.php or the (2) cat parameter to groups.php.
CVE-2013-5311Aug 19, 2013
Vastal
Phpvid
risk 0.03cvss —epss 0.02
Multiple SQL injection vulnerabilities in Vastal I-Tech phpVID 1.2.3 allow remote attackers to execute arbitrary SQL commands via the "n" parameter to (1) browse_videos.php or (2) members.php. NOTE: the cat parameter is already covered by CVE-2008-4157.
CVE-2012-6526Jan 31, 2013
Vastal
Freelance Zone
risk 0.03cvss —epss 0.01
SQL injection vulnerability in show_code.php in Vastal I-Tech Freelance Zone allows remote attackers to execute arbitrary SQL commands via the code_id parameter.
CVE-2012-0982Feb 2, 2012
Vastal
Agent Zone
risk 0.03cvss —epss 0.01
SQL injection vulnerability in search.php in Vastal I-Tech Agent Zone (aka The Real Estate Script) allows remote attackers to execute arbitrary SQL commands via the price_from parameter.
CVE-2009-3496Sep 30, 2009
Vastal
Dvd Zone
risk 0.03cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in view_mag.php in Vastal I-Tech DVD Zone allows remote attackers to inject arbitrary web script or HTML via the mag_id parameter.
CVE-2009-3495Sep 30, 2009
Vastal
Dvd Zone
risk 0.03cvss —epss 0.01
SQL injection vulnerability in view_mag.php in Vastal I-Tech DVD Zone allows remote attackers to execute arbitrary SQL commands via the mag_id parameter, a different vector than CVE-2008-4465.
CVE-2008-6209Feb 20, 2009
Vastal
Software Zone
risk 0.03cvss —epss 0.01
SQL injection vulnerability in view_product.php in Vastal I-Tech Software Zone allows remote attackers to execute arbitrary SQL commands via the cat_id parameter.
CVE-2008-4469Oct 7, 2008
Vastal
Freelance Zone
risk 0.03cvss —epss 0.01
SQL injection vulnerability in view_cresume.php in Vastal I-Tech Freelance Zone allows remote attackers to execute arbitrary SQL commands via the coder_id parameter.
CVE-2008-4468Oct 7, 2008
Vastal
Share Zone
risk 0.03cvss —epss 0.01
SQL injection vulnerability in view_news.php in Vastal I-Tech Share Zone allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVE-2008-4467Oct 7, 2008
Vastal
Toner Cart
risk 0.03cvss —epss 0.01
SQL injection vulnerability in show_series_ink.php in Vastal I-Tech Toner Cart allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVE-2008-4466Oct 7, 2008
Vastal
Cosmetics Zone
risk 0.03cvss —epss 0.01
SQL injection vulnerability in view_products_cat.php in Vastal I-Tech Cosmetics Zone allows remote attackers to execute arbitrary SQL commands via the cat_id parameter.
CVE-2008-4465Oct 7, 2008
Vastal
Dvd Zone
risk 0.03cvss —epss 0.01
SQL injection vulnerability in view_mags.php in Vastal I-Tech DVD Zone allows remote attackers to execute arbitrary SQL commands via the cat_id parameter.
CVE-2008-4464Oct 7, 2008
Vastal
Mag Zone
risk 0.03cvss —epss 0.01
SQL injection vulnerability in view_mags.php in Vastal I-Tech Mag Zone allows remote attackers to execute arbitrary SQL commands via the cat_id parameter.
CVE-2008-4463Oct 7, 2008
Vastal
Jobs Zone
risk 0.03cvss —epss 0.01
SQL injection vulnerability in view_news.php in Vastal I-Tech Jobs Zone allows remote attackers to execute arbitrary SQL commands via the news_id parameter.
CVE-2008-4462Oct 7, 2008
Vastal
Visa Zone
risk 0.03cvss —epss 0.01
SQL injection vulnerability in view_news.php in Vastal I-Tech Visa Zone allows remote attackers to execute arbitrary SQL commands via the news_id parameter.
CVE-2008-4461Oct 7, 2008
Vastal
Dating Zone
risk 0.03cvss —epss 0.01
SQL injection vulnerability in advanced_search_results.php in Vastal I-Tech Dating Zone, possibly 0.9.9, allows remote attackers to execute arbitrary SQL commands via the fage parameter.
CVE-2008-4460Oct 7, 2008
Vastal
Mmorpg Zone
risk 0.03cvss —epss 0.01
SQL injection vulnerability in game.php in Vastal I-Tech MMORPG Zone allows remote attackers to execute arbitrary SQL commands via the game_id parameter.
CVE-2008-4157Sep 22, 2008
Vastal
Phpvid
risk 0.03cvss —epss 0.06
SQL injection vulnerability in groups.php in Vastal I-Tech phpVID 1.1 allows remote attackers to execute arbitrary SQL commands via the cat parameter, a different vector than CVE-2007-3610. NOTE: it was later reported that 1.2.3 is also affected.
CVE-2008-3953Sep 11, 2008
Vastal
Shaadi Zone
risk 0.03cvss —epss 0.01
SQL injection vulnerability in keyword_search_action.php in Vastal I-Tech Shaadi Zone 1.0.9 allows remote attackers to execute arbitrary SQL commands via the tage parameter.
CVE-2008-3951Sep 11, 2008
Vastal
Agent Zone
risk 0.03cvss —epss 0.01
SQL injection vulnerability in view_ann.php in Vastal I-Tech Agent Zone (aka The Real Estate Script) allows remote attackers to execute arbitrary SQL commands via the ann_id parameter.
CVE-2008-2335May 19, 2008
Vastal
Phpvid
risk 0.03cvss —epss 0.04
Cross-site scripting (XSS) vulnerability in search_results.php in Vastal I-Tech phpVID 1.1 and 1.2 allows remote attackers to inject arbitrary web script or HTML via the query parameter. NOTE: some of these details are obtained from third party information. NOTE: it was later…
CVE-2007-3610Jul 6, 2007
Vastal
Phpvid
risk 0.03cvss —epss 0.01
SQL injection vulnerability in categories_type.php in phpVID 0.9.9 allows remote attackers to execute arbitrary SQL commands via the cat parameter.
CVE-2007-3549Jul 3, 2007
Buddy Zone
Buddy Zone
risk 0.03cvss —epss 0.01
SQL injection vulnerability in view_sub_cat.php in Buddy Zone 1.5 allows remote attackers to execute arbitrary SQL commands via the cat_id parameter.
CVE-2007-3526Jul 3, 2007
Vastal
Buddy Zone
risk 0.03cvss —epss 0.02
Multiple SQL injection vulnerabilities in Buddy Zone 1.5 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the news_id parameter to view_news.php, (2) the cat_id parameter to view_events.php, or (3) the member_id parameter to video_gallery.php.
CVE-2015-2563Mar 20, 2015
Vastal
Phpvid
risk 0.00cvss —epss 0.02
SQL injection vulnerability in groups.php in Vastal I-Tech phpVID 0.9.9 and 1.2.3 allows remote attackers to execute arbitrary SQL commands via the order_by parameter. NOTE: The cat parameter vector is already covered by CVE-2008-4157.
CVE-2009-3505Sep 30, 2009
Vastal
Mmorpg Zone
risk 0.00cvss —epss 0.01
SQL injection vulnerability in view_news.php in Vastal I-Tech MMORPG Zone allows remote attackers to execute arbitrary SQL commands via the news_id parameter. NOTE: the game_id vector is already covered by CVE-2008-4460.
CVE-2009-3497Sep 30, 2009
Vastal
Agent Zone
risk 0.00cvss —epss 0.01
SQL injection vulnerability in view_listing.php in Vastal I-Tech Agent Zone (aka The Real Estate Script) allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVE-2006-3494Jul 10, 2006
Vastal
Buddy Zone
risk 0.00cvss —epss 0.03
Multiple cross-site scripting (XSS) vulnerabilities in Buddy Zone 1.0.1 allow remote attackers to inject arbitrary HTML and web script via the (1) cat_id parameter to (a) view_classifieds.php; (2) id parameter in (b) view_ad.php; (3) event_id parameter in (c) view_event.php, (d)…