VendorsWavelink Mediatutorialcmsall versions
Vulnerabilities

Wavelink Media Tutorialcms

Ranked by severity, then by exploit likelihood, unless you sort otherwise. Click a CVE ID for its full record.

4CVEs
CVE-2007-2822
TutorialCMS 1.01 and earlier, when register_globals is enabled, allows remote attackers to bypass authentication via the (1) loggedIn and (2) activated parameters to (a) login.php, (b) headerLinks.php, (c) submit1.php, (d) myFav.php, and (e) userCP.php.
Published 2007-05-22 · Modified
9.31 PoCEPSS 0.044
CVE-2007-2599
Multiple SQL injection vulnerabilities in TutorialCMS (aka Photoshop Tutorials) 1.00 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) catFile parameter to (a) browseCat.php or (b) browseSubCat.php; the (2) id parameter to (c) openTutorial.php, (d) topFrame.php, or (e) admin/editListing.php; or (3) the search parameter to search.php.
Published 2007-05-11 · Modified
7.51 PoCEPSS 0.037
CVE-2007-2600
Multiple cross-site scripting (XSS) vulnerabilities in TutorialCMS (aka Photoshop Tutorials) 1.00 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) catFile parameter to (a) browseCat.php or (b) browseSubCat.php; the (2) id parameter to (c) openTutorial.php, (d) topFrame.php, or (e) admin/editListing.php; or the (3) search parameter to search.php.
Published 2007-05-11 · Modified
6.81 PoCEPSS 0.028
CVE-2008-0254
SQL injection vulnerability in activate.php in TutorialCMS (aka Photoshop Tutorials) 1.02, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the userName parameter.
Published 2008-01-15 · Modified
6.81 PoCEPSS 0.009