James Bercegay

The issue allows remote attackers to determine the existence of arbitrary files or include arbitrary files via directory traversal vulnerabilities. This can be achieved by exploiting the `$tb url` variable in "trackback.php" or the `template` parameter in "settemplate.php" using a .. (dot dot) sequence.

A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the `keyword` parameter in a search action to "user.php" and other unspecified vectors.

The issue allows remote attackers to execute arbitrary SQL commands due to multiple SQL injection vulnerabilities. The vulnerabilities exist in various parameters and variables, including the `id` parameter to "vote.php", the `id` parameter to "trackback.php", an unspecified parameter to "submit.php", the `requestTitle` variable in a query to "story.php", the `requestID` and `requestTitle` variables in "recommend.php", the `categoryID` parameter to "cloud.php", the `title` parameter to "out.php", the `username` parameter to "login.php", the `id` parameter to "cvote.php", and the `commentid` parameter to "edit.php".

Name of the Vulnerable Software and Affected Versions: UBB.threads versions 7.3.1 and earlier Description: The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the `Forum[]` array parameter in the dosearch.inc.php file. Recommendations: For versions 7.3.1 and earlier, update to a version later than 7.3.1 to resolve the issue.

Name of the Vulnerable Software and Affected Versions: CS-Cart versions 1.3.5 and earlier Description: A SQL injection issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the `cs cookies[customer user id]` cookie parameter in the core/user.php file. Recommendations: For CS-Cart versions 1.3.5 and earlier, consider restricting access to the core/user.php file until a patch is available. As a temporary workaround, avoid using the `cs cookies[customer user id]` cookie parameter in the affected file to minimize the risk of exploitation.

A cross-site scripting (XSS) issue exists in the getParameterisedSelfUrl function in index.php, allowing remote attackers to inject arbitrary web script or HTML via the PATH INFO. This could potentially lead to malicious script execution on the client-side.

A directory traversal issue exists in the rss.php file of WebSVN, allowing remote attackers to overwrite arbitrary files when magic quotes gpc is disabled. This is achieved through directory traversal sequences in the `rev` parameter.

The issue allows remote attackers to execute arbitrary PHP code via a crafted `username` that is processed by the `preg replace` function with the `eval` switch. This is due to a problem in the `create anchors` function in `utils.inc`.

The issue allows remote attackers to execute arbitrary PHP code via PHP code embedded in bbcode in the `email` parameter, which is processed by the `preg replace` function with the `eval` switch.

A cross-site scripting (XSS) issue allows remote authenticated users to inject arbitrary web script or HTML via the `Value` field in the Label ==> Value pairs in account.php.

The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the `department` parameter to API endpoints such as "is xmlhttp.php" and "is flush.php".

The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the `id` parameter in an edit registry action to "index.php", a vector involving the `check email` function, and other vectors.

The issue allows remote attackers to overwrite arbitrary variables related to the db config file when register globals is enabled. This can be leveraged for code injection by overwriting the language file.

The issue is related to a lack of input sanitization in the `get` function in `global.php`, allowing remote attackers to execute arbitrary SQL commands. This is achieved by exploiting the `dep` parameter in `onlinestatus html.php`.

The issue allows remote attackers to execute arbitrary PHP code via the `test` parameter, and possibly other parameters, to the "chat.php" endpoint.

The issue allows remote attackers to inject arbitrary web script or HTML via the `NewPassword` parameter to "people.php". Additionally, remote authenticated users can inject arbitrary web script or HTML via the `Account picture` and `Icon` fields in "account.php".

The issue allows remote attackers to execute arbitrary SQL commands, potentially leading to data manipulation or extraction. This can be achieved through the `checked` array parameter to "plog-download.php" in an album action, and unspecified parameters to "plog-remote.php". Additionally, remote authenticated administrators can execute arbitrary SQL commands via the `activate` parameter to "admin/plog-themes.php", related to `theme dir` settings.

The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the `rsargs` array parameter in an `/ajax.php` endpoint, specifically in the ` exp getFeedContent` action.

The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the `category id` parameter in the products rss.php file.

The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via the `pre gallery` or `post gallery` parameters in index.php when register globals is enabled.