High

DATE	CVE	VULNERABILITY TITLE	RISK
2005-06-22	CVE-2005-2048	SQL-Injection vulnerability in Duware Duforum 3.1 Multiple SQL injection vulnerabilities in DUware DUforum 3.1, and possibly other versions, allow remote attackers to execute arbitrary SQL commands via the (1) iMsg parameter to messages.asp, iFor parameter to (2) post.asp or (3) forums.asp, or (4) id parameter to userEdit.asp. network low complexity duware	7.5
2004-12-31	CVE-2004-2201	Remote vulnerability in DUware Software SQL injection vulnerability in DUware DUforum 3.0 through 3.1 allows remote attackers to execute arbitrary SQL commands via the FOR_ID parameter in messages.asp, (2) MSG_ID parameter in messageDetail.asp, or (3) password parameter in the login form. network low complexity duware	7.5