Mywebland vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2008-5004 SQL injection vulnerability in genscode.php in myWebland Bloggie Lite 0.0.2 beta allows remote attackers to execute arbitrary SQL commands via a crafted cookie.High 7.5 · Nov 10, 2008
• CVE-2008-4650 SQL injection vulnerability in viewevent.php in myEvent 1.6 allows remote attackers to execute arbitrary SQL commands via the eventdate parameter.High 7.5 · Oct 21, 2008
• CVE-2008-4644 hits.php in myWebland myStats allows remote attackers to bypass IP address restrictions via a modified X-Forwarded-For HTTP header.High 7.5 · Oct 21, 2008
• CVE-2008-4643 SQL injection vulnerability in hits.php in myWebland myStats allows remote attackers to execute arbitrary SQL commands via the sortby parameter.High 7.5 · Oct 21, 2008
• CVE-2008-4628 SQL injection vulnerability in del.php in myWebland miniBloggie 1.0 allows remote attackers to execute arbitrary SQL commands via the post_id parameter.High 7.5 · Oct 20, 2008
• CVE-2007-3353 PHP remote file inclusion vulnerability in includes/template.php in MyEvent 1.6 allows remote attackers to execute arbitrary PHP code via a URL in the myevent_pHigh 7.5 · Jun 22, 2007
• CVE-2007-3194 Multiple PHP remote file inclusion vulnerabilities in myBloggie 2.1.5 allow remote attackers to execute arbitrary PHP code via a URL in the bloggie_root_path paCritical 9.8 · Jun 12, 2007
• CVE-2007-3003 Multiple SQL injection vulnerabilities in myBloggie 2.1.6 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) cat_id or (2) year paHigh 7.5 · Jun 4, 2007
• CVE-2006-4163 PHP remote file inclusion vulnerability in cls_fast_template.php in myWebland miniBloggie 1.0 and earlier allows remote attackers to execute arbitrary PHP code High 7.5 · Aug 16, 2006
• CVE-2006-4083 PHP remote file inclusion vulnerability in viewevent.php in myWebland myEvent 1.x allows remote attackers to execute arbitrary PHP code via a URL in the myeventHigh 7.5 · Aug 11, 2006
• CVE-2006-4040 PHP remote file inclusion vulnerability in myevent.php in myWebland myEvent 1.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in tHigh 7.5 · Aug 9, 2006
• CVE-2006-4042 Multiple SQL injection vulnerabilities in trackback.php in myWebland myBloggie 2.1.4 and earlier allow remote attackers to execute arbitrary SQL commands via thHigh 7.5 · Aug 9, 2006
• CVE-2006-3905 SQL injection vulnerability in Webland MyBloggie 2.1.3 allows remote attackers to execute arbitrary SQL commands via the (1) post_id parameter in index.php and High 7.5 · Jul 27, 2006
• CVE-2006-2859 PHP remote file inclusion vulnerability in MyBloggie 2.1.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the mybloggie_root_patHigh 7.5 · Jun 6, 2006
• CVE-2006-1907 Multiple SQL injection vulnerabilities in myEvent 1.x allow remote attackers to inject arbitrary SQL commands via the event_id parameter to (1) addevent.php or High 7.5 · Apr 20, 2006
• CVE-2006-1890 Multiple PHP remote file inclusion vulnerabilities in myWebland myEvent 1.2 allow remote attackers to execute arbitrary PHP code via a URL in the myevent_path pHigh 7.5 · Apr 20, 2006
• CVE-2006-0417 SQL injection vulnerability in login.php in miniBloggie 1.0 and earlier, when gpc_magic_quotes is disabled, allows remote attackers to execute arbitrary SQL comHigh 7.5 · Jan 25, 2006
• CVE-2005-4225 Multiple "potential" SQL injection vulnerabilities in myBloggie 2.1.3 beta might allow remote attackers to execute arbitrary SQL commands via (1) the category pHigh 7.5 · Dec 14, 2005
• CVE-2005-3153 login.php in myBloggie 2.1.3 beta and earlier allows remote attackers to bypass a whitelist regular expression and conduct SQL injection attacks via a username High 7.5 · Oct 5, 2005
• CVE-2005-2838 SQL injection vulnerability in login.php in myBloggie 2.1.3-beta and earlier allows remote attackers to execute arbitrary SQL commands via the username parameteHigh 7.5 · Sep 7, 2005
• CVE-2005-1499 delcomment.php in myBloggie 2.1.1 allows remote attackers to delete arbitrary comments by modifying the comment_id parameter.High 7.5 · May 11, 2005
• CVE-2005-1500 Multiple SQL injection vulnerabilities in myBloggie 2.1.1 allow remote attackers to execute arbitrary SQL commands via (1) the keyword parameter in search.php; High 7.5 · May 11, 2005