Benjamin Mossé's advisories

Mambo 4.6.2 Multiple vulnerabilities

Multiple vulnerabilities have been identified in Mambo 4.6.2 which could lead to SQL injections, cross-site scripting, cross-site request forgery attacks, spamming and brute forcing administrator access.

Scite Text Editor v1.71 Null-pointer dereference

aBitWhizzy PHP Directory Traversal Vulnerability

A vulnerability was reported in aBitWhizzy. A remote user can include and execute local files on the target system.

JiRos Links Manager SQL Injections and Cross-Site Scripting Attacks

A vulnerability was reported in JiRo's Link Manager. A remote user can injection SQL commands. A remote user can conduct cross-site scripting attacks.

Link Exchange Lite SQL Injections Attacks

Multiple vulnerabilities have been identified in SoftAcid Link Exchange Lite, which could be exploited by remote attackers to execute arbitrary SQL commands. These flaws are due to input validation errors in the "search.asp" and "linkslist.asp" scripts that do not validate the "url" and "psearch" parameters before being used in SQL statements, which could be exploited by malicious people to conduct SQL injection attacks.

CreaDirectory Multiple Parameter Handling Remote Cross-Site Scripting and SQL Injection Vulnerabilities

Multiple input validation vulnerabilities in CreaDirectory have been reported, which can be exploited by remote users to conduct cross-site scripting and SQL injection attacks.

Classified System 2004 Multiple Parameter Handling Remote Cross-Site Scripting and SQL Injection Vulnerabilities

Multiple input validation vulnerabilities in Classified System 2004 have been reported, which can be exploited by remote users to conduct cross-site scripting and SQL injection attacks.

Rialto 1.x Multiple Parameter Handling Remote Cross-Site Scripting and SQL Injection Vulnerabilities

Multiple input validation vulnerabilities in Rialto have been reported, which can be exploited by remote users to conduct cross-site scripting and SQL injection attacks.

Enthrallweb eHomes Remote Cross-Site Scripting and SQL Injection Vulnerabilities

Multiple input validation vulnerabilities in Enthrallweb eHomes have been reported, which can be exploited by remote users to conduct cross-site scripting and SQL injection attacks.

The Classified Ad System Multiple Parameter Handling Remote Cross-Site Scripting and SQL Injection Vulnerabilities

Multiple input validation vulnerabilities in The Classifieds Ad System have been reported, which can be exploited by remote users conduct SQL injection and cross-site scripting vulnerabilities.

Rapid Classified 3.1 Remote Cross-Site Scripting and SQL Injection Vulnerabilities

Multiple input validation vulnerabilities in Rapid Classified have been reported, which can be exploited by remote users to conduct cross-site scripting and SQL injection attacks.

Enthrallweb eClassifieds Multiple Parameter Handling Remote SQL Injection Vulnerabilities

Multiple input validation vulnerabilities in Enthrallweb eClassifieds have been reported, which can be exploited by remote users to conduct SQL injection attacks.

Vikingboard 0.1.2 Remote Cross-Site Scripting and Arbitrary File Inclusion Vulnerabilities

Multiple input validation vulnerabilities in Vikingboard have been reported, which can be exploited by remote users to disclose certain sensitive information and conduct script insertion attacks.

BestWebApp Dating Site Multiple Parameter Handling Remote Cross-Site Scripting and SQL Injection Vulnerabilities

Multiple input validation vulnerabilities in BestWebApp Dating Site have been reported, which can be exploited by remote users to conduct cross-site scripting and SQL injection attacks.

ASPCart 4.x Multiple Parameter Handling Remote SQL Injection Vulnerabilities

Some vulnerabilities in ASPCart have been reported, which can be exploited by remote users to conduct SQL injection attacks.

20/20 Auto GalleryRemote Multiple Parameter Handling Remote SQL Injection Vulnerabilities

Multiple vulnerabilities in 20/20 Auto Gallery have been reported, which can be exploited by remote users to conduct SQL injection attacks.

phpMyAdmin 2.9.1 Table Comment Remote Cross-Site Scripting Vulnerability

A vulnerability in phpMyAdmin have been reported, which can be exploited by remote users to conduct cross-site scripting attacks.

E-Calendar Pro 3.0 Multiple Parameter Handling Remote SQL Injection Vulnerabilities

Some vulnerabilities in E-Calendar Pro have been reported, which can be exploited by remote users to conduct SQL injection attacks.

Dragon Internet Events Listing 2.x Multiple Parameter Handling Remote SQL Injection Vulnerability

Some vulnerabilities in Dragon Internet Events Listing have been reported, which can be exploited by remote users to conduct SQL injection attacks.

Inventory Manager Multiple Parameter Handling Remote SQL Injection Vulnerabilities

Cross Site Scripting, Manipulation of data

Hpecs Shopping Cart Multiple SQL Injection Vulnerabilities

Some vulnerabilities in Hpecs Shopping Cart, which can be exploited by malicious people to conduct SQL injection attacks.

FunkyASP Glossary 1.0 SQL Injection Vulnerability

Some vulnerabilities in FunkyASP Glossary 1.0, which can be exploited by malicious people to conduct SQL injection attacks.

Enthrallweb eShopping Cart Multiple Parameter Handling Remote SQL Injection Vulnerability

Some vulnerabilities in Enthrallweb eShopping Cart have been reported, which can be exploited by remote users to conduct SQL injection attacks.

E-commerce Kit-1 PayPal Edition Multiple SQL Injections

Some vulnerabilities in E-commerce Kit-1 PayPal Edition, which can be exploited by malicious people to conduct SQL injection attacks.

Car Site Manager Remote SQL Injection And Cross-Site Scripting Vulnerabilities

Some vulnerabilities in Car Site Manager, which can be exploited by malicious people to conduct SQL injection attacks and cross-site scripting attacks.

CandyPress Store 'policy' and 'brand' Parameter Handling Remote SQL Injection Vulnerabilities

Some vulnerabilities in CandyPress Store have been reported, which can be exploited by remote users to conduct SQL injection attacks.

BlogMe Script 3 SQL Injections and Cross-Site Scripting Attacks

Some vulnerabilities in BlogMe, which can be exploited by malicious people to conduct script insertion and SQL injection attacks.

A+ Store E-Commerce SQL Injection and Cross-Site Scripting

Two vulnerabilities in A+ Store E-Commerce have been reported, which can be exploited by remote users to conduct SQL injection and cross-site scripting attacks.

myStats Multiple Parameter Handling Remote SQL Injection And Cross-Site Scripting Vulnerabilities

Two input validation vulnerabilities in myStats have been reported, which can be exploited by remote users to conduct SQL injection and cross-site scripting attacks.

INFINICART Remote Cross-Site Scripting and SQL Injection Vulnerabilities

Two vulnerabilities in INFINICART have been reported, which can be exploited by remote users to conduct cross-site scripting and SQL injection attacks.

OmniStar Article Multiple Parameter Handling Remote SQL Injection Vulnerabilities

Multiple vulnerabilities in OmniStar Article have been reported, which can be exploited by remote users to conduct SQL injection attacks.

Wheatblog 1.x Comment Multiple Paramater Handling Remote Cross-Site Scripting Vulnerability

Multiple input validation vulnerabilities in Wheatblog have been reported, which can be exploited by remote users or users to conduct script insertion attacks.

SpeedyWiki 2.0 File Upload And Cross-Site Scripting Vulnerabilities

Two vulnerabilities in SpeedyWiki have been reported, which can be exploited by remote users to compromise a vulnerable system and to conduct cross-site scripting attacks.

LandShop Multiple Parameter Handling Remote Cross-Site Scripting and SQL Injection Vulnerabilities

Multiple vulnerabilities in Landshop have been reported, which can be exploited by remote users to conduct cross-site scripting and SQL injection attacks.

FreeWebshop Script 2.2.2 Local File Inclusion and Cross-Site Scripting Vulnerabilities

Two vulnerabilities in FreeWebshop.org Script have been reported, which can be exploited by remote users to disclose sensitive information or conduct cross-site scripting attacks.

Bitweaver 1.3.1 Remote SQL Injection and Cross-Site Scripting Vulnerabilities

Two input validation vulnerabilities in bitweaver have been reported, which can be exploited by remote users to conduct SQL injection and cross-site scripting attacks.

All In One Control Panel (AIOCP) 1.3.007 Multiple SQL Injection and Cross Site Scripting Vulnerabilities

Multiple vulnerabilities in All In One Control Panel (AIOCP) have been reported, which can be exploited by remote users to conduct SQL injection attacks or cross-site scripting attacks.

Portix-PHP SQL Injection Attack to bypass authentification and Cross-Site Scripting Attack

SQL Injection allowing hacker to bypass login authentification and cross site scripting attacks

Abarcar Realty Portal 'neid' and 'slid' Paramater Handling Remote SQL Injection Vulnerabilities

Some vulnerabilities in Abarcar Realty Portal have been reported, which can be exploited by remote users to conduct SQL injection attacks.

If-CMS Missing Input Validation in 'rns' Parameter Permits Cross-Site Scripting Attacks

A vulnerability was reported in If-CMS. A remote user can conduct cross-site scripting attacks.