Vulnerabilities > Devellion

DATE CVE VULNERABILITY TITLE RISK
2007-05-24 CVE-2007-2862 SQL Injection vulnerability in Devellion Cubecart 3.0.16
Multiple SQL injection vulnerabilities in CubeCart 3.0.16 might allow remote attackers to execute arbitrary SQL commands via an unspecified parameter to cart.inc.php and certain other files in an include directory, related to missing sanitization of the $option variable and possibly cookie modification.
network
low complexity
devellion
7.5
2007-05-09 CVE-2007-2550 HTTP Response Splitting vulnerability in Devellion Cubecart 3.0.15
Multiple CRLF injection vulnerabilities in Devellion CubeCart 3.0.15 allow remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in a cookie name beginning with "ccSID" to (1) cart.php or (2) index.php.
network
low complexity
devellion
5.0
2006-10-03 CVE-2006-5109 Input Validation vulnerability in CubeCart
Devellion CubeCart 2.0.x allows remote attackers to obtain sensitive information via a direct request for (1) link_navi.php or (2) spotlight.php, which reveals the path in various error messages.
network
low complexity
devellion
5.0
2006-10-03 CVE-2006-5108 Input Validation vulnerability in CubeCart
Multiple cross-site scripting (XSS) vulnerabilities in Devellion CubeCart 2.0.x allow remote attackers to inject arbitrary web script or HTML via the order_id parameter in (1) admin/print_order.php and (2) view_order.php; the (3) site_url and (4) la_search_home parameters and (5) certain language parameters in admin/nav.php; the (6) image parameter in admin/image.php; the (7) site_name, (8) la_adm_header, (9) charset, and (10) certain other parameters in admin/header.inc.php; the (12) la_pow_by parameter in footer.inc.php; and the (13) site_name parameter and (14) certain other parameters in header.inc.php.
network
devellion
6.8
2006-10-03 CVE-2006-5107 Input Validation vulnerability in CubeCart
Multiple SQL injection vulnerabilities in Devellion CubeCart 2.0.x allow remote attackers to execute arbitrary SQL commands via (1) the user_name parameter in admin/forgot_pass.php, (2) the order_id parameter in view_order.php, (3) the view_doc parameter in view_doc.php, and (4) the order_id parameter in admin/print_order.php.
network
low complexity
devellion
7.5
2006-09-01 CVE-2006-4527 Multiple Security vulnerability in Devellion Cubecart 3.0.12
includes/content/gateway.inc.php in CubeCart 3.0.12 and earlier, when magic_quotes_gpc is disabled, uses an insufficiently restrictive regular expression to validate the gateway parameter, which allows remote attackers to conduct PHP remote file inclusion attacks.
network
high complexity
devellion
2.6
2006-09-01 CVE-2006-4526 Multiple Security vulnerability in CubeCart
SQL injection vulnerability in includes/content/viewCat.inc.php in CubeCart 3.0.12 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary SQL commands via the searchArray[] parameter.
network
low complexity
devellion
7.5
2006-09-01 CVE-2006-4525 Multiple Security vulnerability in CubeCart
Cross-site scripting (XSS) vulnerability in CubeCart 3.0.12 and earlier, when register_globals is enabled, allows remote attackers to inject arbitrary web script or HTML via the links array.
network
devellion
4.3
2006-08-21 CVE-2006-4268 Input Validation vulnerability in CubeCart
Multiple cross-site scripting (XSS) vulnerabilities in CubeCart 3.0.11 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) file, (2) x, and (3) y parameters in (a) admin/filemanager/preview.php; and the (4) email parameter in (b) admin/login.php.
network
devellion
6.8
2006-08-21 CVE-2006-4267 Input Validation vulnerability in CubeCart
Multiple SQL injection vulnerabilities in CubeCart 3.0.11 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) oid parameter in modules/gateway/Protx/confirmed.php and the (2) x_invoice_num parameter in modules/gateway/Authorize/confirmed.php.
network
low complexity
devellion
7.5