8 results (0.004 seconds)

CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0

CVE-2010-4500

https://notcve.org/view.php?id=CVE-2010-4500

Multiple SQL injection vulnerabilities in contact.php in MRCGIGUY (MCG) FreeTicket 1.0.0, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) name, (2) email, (3) subject, and (4) message parameters in a sendmess action. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Múltiples vulnerabilidades de inyección SQL en contact.php de MRCGIGUY (MCG) FreeTicket v1.0.0, cuando magic_quotes_gpc está deshabilitada, permite a los atacantes remotos ejecutar comandos SQL a su elección a través de los parámetros (1) name, (2) email, (3) subject, y (4) message en una acción sendmess (enviar mensaje). NOTA: el origen de esta información es desconocidos. Algunos detalles han sido obtenidos únicamente de terceras personas. • http://secunia.com/advisories/42313 http://www.securityfocus.com/bid/45067 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •

CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 2

CVE-2010-4358

https://notcve.org/view.php?id=CVE-2010-4358

Multiple cross-site scripting (XSS) vulnerabilities in gb.cgi in MRCGIGUY (MCG) Guestbook 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) email, (3) website, and (4) message parameters. Múltiples vulnerabilidades de ejecución de secuencias de comandos cruzados (XSS) en gb.cgi en MRCGIGUY (MCG) Guestbook v1.0, permite a atacantes remotos ejecutar secuencias de comandos web o HTML de su elección a través de los parámetros (1) name, (2) email, (3) website, y (4) message. • http://evuln.com/vulns/144/summary.html http://packetstormsecurity.org/files/view/96101/mcgguestbook-xss.txt http://secunia.com/advisories/42315 http://www.securityfocus.com/archive/1/514884/100/0/threaded http://www.securityfocus.com/bid/45043 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 3

CVE-2010-4363

https://notcve.org/view.php?id=CVE-2010-4363

Multiple SQL injection vulnerabilities in contact.php in MRCGIGUY (MCG) FreeTicket 1.0.0, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) id and (2) email parameters in a showtickets action. Múltiples vulnerabilidades en contact.php en MRCGIGUY (MCG) FreeTicket v1.0.0, cuando están desactivadas las magic_quotes, permite a atacantes remotos ejecutar comandos SQL de su elección a través de los parámetros (1) id y (2) email en una acción "Showtickets". • http://evuln.com/vulns/146/summary.html http://packetstormsecurity.org/files/view/96138/freeticket-sql.txt http://secunia.com/advisories/42313 http://www.osvdb.org/69488 http://www.securityfocus.com/archive/1/514890/100/0/threaded http://www.securityfocus.com/bid/45053 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •

CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 1

CVE-2008-7121

https://notcve.org/view.php?id=CVE-2008-7121

Cross-site scripting (XSS) vulnerability in Mr. CGI Guy Hot Links SQL-PHP 3 and earlier allows remote attackers to inject arbitrary web script or HTML via the search bar. Una vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en Mr. CGI Guy Hot Links SQL-PHP v3 y anteriores permite a atacantes remotos inyectar HTML o scripts web a través de la barra de búsqueda. • http://www.packetstormsecurity.org/0809-exploits/hotlinks-sql.txt • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 3

CVE-2008-7120 – Hot Links SQL-PHP - 'news.php' SQL Injection

https://notcve.org/view.php?id=CVE-2008-7120

SQL injection vulnerability in Mr. CGI Guy Hot Links SQL-PHP 3 and earlier allows remote attackers to execute arbitrary SQL commands via the news.php parameter. Una vulnerabilidad de inyección SQL en Mr. CGI Guy Hot Links SQL-PHP v3 y anteriores permite a atacantes remotos ejecutar comandos SQL a través del parámetro news.php. • https://www.exploit-db.com/exploits/32355 http://www.packetstormsecurity.org/0809-exploits/hotlinks-sql.txt http://www.securityfocus.com/bid/31118 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •