U238

The issue affects the GLPI Agent, a generic management agent, when running the remoteinventory task against a Unix platform using the ssh command. An administrator user on the remote system can inject a command into a specific workflow that the agent runs with its privileges. If the agent is running with administration privileges, a malicious user could gain high privileges on the computer running the GLPI Agent. Additionally, a malicious user could disclose all remote accesses configured for the remoteinventory task.

The issue allows remote authenticated administrators to execute arbitrary SQL commands via the `sid` parameter to API endpoints such as "kanal.asp", "google.asp", and "hakk.asp" in the "yonet/" directory. Additionally, remote attackers can execute arbitrary SQL commands via the `username` or `password` fields to the "yonet/default.asp" endpoint.

The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the `id` parameter to several API endpoints: "urun.asp", "admin/bayi listele.asp", "admin/urun grup listele.asp", and "admin/urun listele.asp".

The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the "id" parameter to the "/secure/admin/guncelle.asp" API endpoint, the `kulad` and `sifre` parameters to the "/secure/admin/giris.asp" API endpoint, and the `username` and `password` parameters to the "/secure/admin/default.asp" API endpoint.

SQL injection vulnerability in home/index.asp in fipsCMS light 2.1 and earlier allows remote attackers to execute arbitrary SQL commands via the r parameter, a different vector than CVE-2006-6115 and CVE-2007-2561.

Name of the Vulnerable Software and Affected Versions: Meto Forum version 1.1 Description: The issue allows remote attackers to execute arbitrary SQL commands. This is achieved through SQL injection vulnerabilities in various parameters, including the `id` parameter to "admin/duzenle.asp" and "admin oku.asp", the `kid` parameter to "kategori.asp" and "admin kategori.asp", and unspecified parameters to "uye.asp" and "oku.asp". Recommendations: For Meto Forum version 1.1, consider restricting access to the affected API endpoints "admin/duzenle.asp", "admin oku.asp", "kategori.asp", "admin kategori.asp", "uye.asp", and "oku.asp" until a patch is available. As a temporary workaround, avoid using the `id` and `kid` parameters in the respective affected endpoints.

The issue is related to a cross-site scripting (XSS) vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML via the `sayfa` parameter in the `/hpz/admin/Default.asp` API endpoint.

The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the `id` parameter to API endpoints such as "hpz/profil.asp" and "hpz/prodetail.asp".

Multiple SQL injection vulnerabilities in W1L3D4 Philboard 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) id and (2) topic parameters to (a) philboard reply.asp, and the (3) forumid parameter to (b) philboard newtopic.asp, different vectors than CVE-2007-2641 and CVE-2007-0920.

The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the `id` parameter in the "view.asp" file.