Alstrasoft vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2008-6932 Unrestricted file upload vulnerability in submit_file.php in AlstraSoft SendIt Pro allows remote attackers to execute arbitrary code by uploading a file with anHigh 7.5 · Aug 11, 2009
• CVE-2008-5751 SQL injection vulnerability in index.php in AlstraSoft Web Email Script Enterprise (ESE) allows remote attackers to execute arbitrary SQL commands via the id paHigh 7.5 · Dec 30, 2008
• CVE-2008-5650 SQL injection vulnerability in the login directory in AlstraSoft Web Host Directory allows remote attackers to execute arbitrary SQL commands via the pwd parameHigh 7.5 · Dec 17, 2008
• CVE-2008-5649 SQL injection vulnerability in admin/admin.php in AlstraSoft Article Manager Pro 1.6 allows remote attackers to execute arbitrary SQL commands via the username High 10 · Dec 17, 2008
• CVE-2008-3954 SQL injection vulnerability in index.php in AlstraSoft Forum Pay Per Post Exchange allows remote attackers to execute arbitrary SQL commands via the cat parametHigh 7.5 · Sep 10, 2008
• CVE-2008-3386 SQL injection vulnerability in album.php in AlstraSoft Video Share Enterprise 4.51 allows remote attackers to execute arbitrary SQL commands via the UID parametHigh 7.5 · Jul 30, 2008
• CVE-2008-3240 SQL injection vulnerability in index.php in AlstraSoft Affiliate Network Pro allows remote attackers to execute arbitrary SQL commands via the pgm parameter in High 7.5 · Jul 21, 2008
• CVE-2008-2902 SQL injection vulnerability in profile.php in AlstraSoft AskMe Pro 2.1 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameteHigh 7.5 · Jun 30, 2008
• CVE-2008-0429 SQL injection vulnerability in index.php in AlstraSoft Forum Pay Per Post Exchange 2.0 allows remote attackers to execute arbitrary SQL commands via the catid pHigh 7.5 · Jan 23, 2008
• CVE-2007-6106 SQL injection vulnerability in index.php in AlstraSoft E-Friends 4.98 and earlier allows remote attackers to execute arbitrary SQL commands via the seid parametHigh 7.5 · Nov 23, 2007
• CVE-2007-4084 Multiple SQL injection vulnerabilities in AlstraSoft Affiliate Network Pro allow remote attackers to execute arbitrary SQL commands via (1) the pgmid parameter High 7.5 · Jul 30, 2007
• CVE-2007-2824 SQL injection vulnerability in paypal.php in AlstraSoft E-Friends 4.21 and earlier allows remote attackers to execute arbitrary SQL commands via the pack parameHigh 10 · May 22, 2007
• CVE-2007-2775 AlstraSoft Live Support 1.21 sends a redirect to the web browser but does not exit when administrative credentials are missing, which allows remote attackers toHigh 10 · May 21, 2007
• CVE-2007-2776 AlstraSoft Template Seller Pro 3.25 and earlier sends a redirect to the web browser but does not exit when administrative credentials are missing, which allows High 10 · May 21, 2007
• CVE-2007-2777 Unrestricted file upload vulnerability in admin/addsptemplate.php in AlstraSoft Template Seller Pro 3.25 and earlier allows remote attackers to execute arbitrarHigh 7.5 · May 21, 2007
• CVE-2007-2017 siteadmin/useredit.php in AlstraSoft Video Share Enterprise does not check authentication, which allows remote attackers to obtain or modify user information viHigh 7.5 · Apr 12, 2007
• CVE-2006-6818 AlstraSoft Web Host Directory allows remote attackers to bypass authentication and change the admin password via a direct request to admin/config.High 7.5 · Dec 29, 2006
• CVE-2006-4913 Directory traversal vulnerability in chat/getStartOptions.php in AlstraSoft E-friends 4.85 allows remote attackers to include arbitrary local files and possiblyHigh 7.5 · Sep 20, 2006
• CVE-2006-4591 Multiple PHP remote file inclusion vulnerabilities in AlstraSoft Template Seller, and possibly AltraSoft Template Seller Pro 3.25, allow remote attackers to exeHigh 7.5 · Sep 6, 2006
• CVE-2006-4443 PHP remote file inclusion vulnerability in myajaxphp.php in AlstraSoft Video Share Enterprise allows remote attackers to execute arbitrary PHP code via a URL inHigh 7.5 · Aug 29, 2006
• CVE-2006-2616 SQL injection vulnerability in the search script in (1) AlstraSoft Web Host Directory 1.2, aka (2) HyperStop WebHost Directory 1.2, allows remote attackers to eHigh 7.5 · May 25, 2006
• CVE-2006-2565 SQL injection vulnerability in Alstrasoft Article Manager Pro 1.6 allows remote attackers to execute arbitrary SQL commands via (1) the author_id parameter in pHigh 7.5 · May 24, 2006
• CVE-2005-3793 Multiple SQL injection vulnerabilities in AlstraSoft Affiliate Network Pro 7.2 allow remote attackers to bypass authentication and execute arbitrary SQL commandHigh 7.5 · Nov 24, 2005
• CVE-2005-3796 Direct static code injection vulnerability in admin_options_manage.php in AlstraSoft Affiliate Network Pro 7.2 allows attackers to execute arbitrary PHP code viHigh 7.5 · Nov 24, 2005
• CVE-2005-3797 PHP remote file inclusion vulnerability in payment_paypal.php in AlstraSoft Template Seller Pro 3.25 allows remote attackers to execute arbitrary PHP code via tHigh 7.5 · Nov 24, 2005