Show filters
15 Total Results
Displaying 11-15 of 15
Sort by:
Attacker Value
Unknown
CVE-2011-3815
Disclosure Date: September 24, 2011 (last updated October 04, 2023)
WeBid 1.0.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by js/calendar.php and certain other files.
0
Attacker Value
Unknown
CVE-2008-7117
Disclosure Date: August 28, 2009 (last updated October 04, 2023)
eledicss.php in WeBid auction script 0.5.4 allows remote attackers to modify arbitrary cascading style sheets (CSS) files via a certain request with the file parameter set to style.css. NOTE: this can probably be leveraged for cross-site scripting (XSS) attacks.
0
Attacker Value
Unknown
CVE-2008-7118
Disclosure Date: August 28, 2009 (last updated October 04, 2023)
WeBid auction script 0.5.4 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain SQL query logs via a direct request for logs/cron.log.
0
Attacker Value
Unknown
CVE-2008-7116
Disclosure Date: August 28, 2009 (last updated October 04, 2023)
SQL injection vulnerability in the admin panel (admin/) in WeBid auction script 0.5.4 allows remote attackers to execute arbitrary SQL commands via the username.
0
Attacker Value
Unknown
CVE-2008-7119
Disclosure Date: August 28, 2009 (last updated October 04, 2023)
SQL injection vulnerability in item.php in WeBid auction script 0.5.4 allows remote attackers to execute arbitrary SQL commands via the id parameter.
0
