Vulnerabilities > Alstrasoft > High
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2007-05-21 | CVE-2007-2777 | Multiple vulnerability in AlstraSoft Template Seller Pro Unrestricted file upload vulnerability in admin/addsptemplate.php in AlstraSoft Template Seller Pro 3.25 and earlier allows remote attackers to execute arbitrary PHP code via an arbitrary .php filename in the zip parameter, which is created under sptemplates/. | 7.5 |
| 2007-04-12 | CVE-2007-2017 | Remote vulnerability in AlstraSoft Video Share Enterprise siteadmin/useredit.php in AlstraSoft Video Share Enterprise does not check authentication, which allows remote attackers to obtain or modify user information via a direct request. | 7.5 |
| 2006-12-29 | CVE-2006-6818 | Unspecified vulnerability in Alstrasoft Webhost Directory AlstraSoft Web Host Directory allows remote attackers to bypass authentication and change the admin password via a direct request to admin/config. | 7.5 |
| 2006-09-21 | CVE-2006-4913 | Local File Include vulnerability in Alstrasoft E-Friends 4.85 Directory traversal vulnerability in chat/getStartOptions.php in AlstraSoft E-friends 4.85 allows remote attackers to include arbitrary local files and possibly execute arbitrary code via a .. | 7.5 |
| 2006-09-06 | CVE-2006-4591 | Remote File Include vulnerability in Alstrasoft Template Seller 3.25 Multiple PHP remote file inclusion vulnerabilities in AlstraSoft Template Seller, and possibly AltraSoft Template Seller Pro 3.25, allow remote attackers to execute arbitrary PHP code via a URL in the config[template_path] parameter to (1) payment/payment_result.php or (2) /payment/spuser_result.php. | 7.5 |
| 2006-08-29 | CVE-2006-4443 | Remote File Include vulnerability in Alstrasoft Video Share Enterprise 4.0 PHP remote file inclusion vulnerability in myajaxphp.php in AlstraSoft Video Share Enterprise allows remote attackers to execute arbitrary PHP code via a URL in the config[BASE_DIR] parameter. | 7.5 |
| 2006-05-26 | CVE-2006-2616 | SQL-Injection vulnerability in Alstrasoft Webhost Directory 1.2 SQL injection vulnerability in the search script in (1) AlstraSoft Web Host Directory 1.2, aka (2) HyperStop WebHost Directory 1.2, allows remote attackers to execute arbitrary SQL commands via the uri parameter. | 7.5 |
| 2006-05-24 | CVE-2006-2565 | SQL-Injection vulnerability in Alstrasoft Article Manager PRO 1.6 SQL injection vulnerability in Alstrasoft Article Manager Pro 1.6 allows remote attackers to execute arbitrary SQL commands via (1) the author_id parameter in profile.php and (2) the aut_id parameter in userarticles.php. | 7.5 |
| 2005-11-24 | CVE-2005-3798 | Unspecified vulnerability in Alstrasoft Template Seller 3.25 SQL injection vulnerability in admin/index.php in AlstraSoft Template Seller Pro 3.25 allows remote attackers to execute arbitrary SQL commands via the username field. | 7.5 |
| 2005-11-24 | CVE-2005-3797 | Remote File Include vulnerability in Alstrasoft Template Seller 3.25 PHP remote file inclusion vulnerability in payment_paypal.php in AlstraSoft Template Seller Pro 3.25 allows remote attackers to execute arbitrary PHP code via the config[basepath] parameter. | 7.5 |