# CVEs published 2005-12-05

36 CVEs were published on December 5, 2005: 0 critical, 0 high. Days are UTC.

- [CVE-2005-4008](https://cve.now/CVE-2005-4008.md): SQL injection vulnerability in jax\_calendar.php in Jax Calendar 1.34 allows remote attackers to execute arbitrary SQL commands via the (1) c (no CVSS)
- [CVE-2005-4009](https://cve.now/CVE-2005-4009.md): Multiple SQL injection vulnerabilities in PHP Lite Calendar Express 2.2 and earlier allow remote attackers to execute arbitrary SQL commands (no CVSS)
- [CVE-2005-4010](https://cve.now/CVE-2005-4010.md): SQL injection vulnerability in KBase Express 1.0.0 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) id para (no CVSS)
- [CVE-2005-4011](https://cve.now/CVE-2005-4011.md): SQL injection vulnerability in calendar.php in Codewalkers ltwCalendar (aka PHP Event Calendar) 4.2, 4.1.3, and earlier allows remote attack (no CVSS)
- [CVE-2005-4012](https://cve.now/CVE-2005-4012.md): Multiple cross-site scripting (XSS) vulnerabilities in PHP Web Statistik 1.4 allows remote attackers to inject arbitrary web script or HTML (no CVSS)
- [CVE-2005-4013](https://cve.now/CVE-2005-4013.md): PHP Web Statistik 1.4 stores the stat.cfg file under the web root with insufficient access control, which allows remote attackers to obtain (no CVSS)
- [CVE-2005-4014](https://cve.now/CVE-2005-4014.md): stat.php in PHP Web Statistik 1.4 allows remote attackers to cause a denial of service (CPU consumption) via a large lastnumber value. (no CVSS)
- [CVE-2005-4015](https://cve.now/CVE-2005-4015.md): PHP Web Statistik 1.4 does not rotate the log database or limit the size of the referer field, which allows remote attackers to fill the log (no CVSS)
- [CVE-2005-4016](https://cve.now/CVE-2005-4016.md): SQL injection vulnerability in Widget Property 1.1.19 allows remote attackers to execute arbitrary SQL commands via the (1) property\_id, (2) (no CVSS)
- [CVE-2005-4017](https://cve.now/CVE-2005-4017.md): property.php in Widget Property 1.1.19 allows remote attackers to obtain the full server path via an invalid lang value, which leaks the pat (no CVSS)
- [CVE-2005-4018](https://cve.now/CVE-2005-4018.md): SQL injection vulnerability in ls.php in Landshop Real Estate Commerce System 0.6.3 and earlier allows remote attackers to execute arbitrary (no CVSS)
- [CVE-2005-4019](https://cve.now/CVE-2005-4019.md): SQL injection vulnerability in index.php in Relative Real Estate Systems 1.02 and earlier allows remote attackers to execute arbitrary SQL c (no CVSS)
- [CVE-2005-4020](https://cve.now/CVE-2005-4020.md): SQL injection vulnerability in create.php in Widget Imprint 1.0.26 and earlier allows remote attackers to execute arbitrary SQL commands via (no CVSS)
- [CVE-2005-4021](https://cve.now/CVE-2005-4021.md): The installer for Gallery 2.0 before 2.0.2 stores the install log under the web document root with insufficient access control, which allows (no CVSS)
- [CVE-2005-4022](https://cve.now/CVE-2005-4022.md): Cross-site scripting (XSS) vulnerability in the "Add Image From Web" feature in Gallery 2.0 before 2.0.2 allows remote attackers to inject a (no CVSS)
- [CVE-2005-4023](https://cve.now/CVE-2005-4023.md): Unspecified vulnerability in the zipcart module in Gallery 2.0 before 2.0.2 allows remote attackers to read arbitrary files via unknown vect (no CVSS)
- [CVE-2005-4024](https://cve.now/CVE-2005-4024.md): Cross-site scripting (XSS) vulnerability in Interspire FastFind 2004 and 2005 allows remote attackers to inject arbitrary web script or HTML (no CVSS)
- [CVE-2005-4025](https://cve.now/CVE-2005-4025.md): Help Desk Reloaded Free Help Desk does not remove or protect install.php once installation is complete, which allows remote attackers to gai (no CVSS)
- [CVE-2005-4026](https://cve.now/CVE-2005-4026.md): search.php in Geeklog 1.4.x before 1.4.0rc1, and 1.3.x before 1.3.11sr3, allows remote attackers to obtain sensitive information via invalid (no CVSS)
- [CVE-2005-4027](https://cve.now/CVE-2005-4027.md): SQL injection vulnerability in SimpleBBS 1.1 allows remote attackers to execute arbitrary SQL commands via unspecified search module paramet (no CVSS)
- [CVE-2005-4028](https://cve.now/CVE-2005-4028.md): Multiple cross-site scripting (XSS) vulnerabilities in aMember allow remote attackers to inject arbitrary web script or HTML via the (1) lam (no CVSS)
- [CVE-2005-4029](https://cve.now/CVE-2005-4029.md): WebEOC before 6.0.2 allows remote attackers to obtain valid usernames via the HTML source of the WebEOC login webpage, which could be useful (no CVSS)
- [CVE-2005-4005](https://cve.now/CVE-2005-4005.md): SQL injection vulnerability in messages.php in PHP-Fusion 6.00.109 allows remote attackers to obtain path information and possibly execute a (no CVSS)
- [CVE-2005-4006](https://cve.now/CVE-2005-4006.md): SAPID CMS before 1.2.3.03 allows remote attackers to bypass authentication via direct requests to the usr/system files (1) insert\_file.php, (no CVSS)
- [CVE-2005-4007](https://cve.now/CVE-2005-4007.md): Multiple unspecified vulnerabilities in SAPID CMS before 1.2.3.03, related to newly registered users and possibly authorization checks, have (no CVSS)
- [CVE-2005-3993](https://cve.now/CVE-2005-3993.md): Multiple unspecified vulnerabilities in MailEnable Professional 1.6 and earlier and Enterprise 1.1 and earlier allow attackers to cause a de (no CVSS)
- [CVE-2005-3995](https://cve.now/CVE-2005-3995.md): Format string vulnerability in the dosyslog function in the OBEX server (obexsrv.c) for Sobexsrv before 1.0.0-pre4, when the syslog (-S) fun (no CVSS)
- [CVE-2005-3996](https://cve.now/CVE-2005-3996.md): SQL injection vulnerability in admin/password\_forgotten.php in Zen Cart 1.2.6d and earlier allows remote attackers to execute arbitrary SQL (no CVSS)
- [CVE-2005-3997](https://cve.now/CVE-2005-3997.md): Zen Cart 1.2.6d and earlier, under certain PHP configurations, allows remote attackers to obtain sensitive information via direct requests t (no CVSS)
- [CVE-2005-3998](https://cve.now/CVE-2005-3998.md): Cross-site scripting (XSS) vulnerability in search.asp in Solupress News 1.0 and earlier allows remote attackers to inject arbitrary web scr (no CVSS)
- [CVE-2005-3999](https://cve.now/CVE-2005-3999.md): Cross-site scripting (XSS) vulnerability in Search.asp in SiteBeater MP3 Catalog 2.03 and earlier allows remote attackers to inject arbitrar (no CVSS)
- [CVE-2005-4000](https://cve.now/CVE-2005-4000.md): Cross-site scripting (XSS) vulnerability in archive.asp in SiteBeater News System 4.00 and earlier allows remote attackers to inject arbitra (no CVSS)
- [CVE-2005-4001](https://cve.now/CVE-2005-4001.md): Multiple SQL injection vulnerabilities in phpYellowTM Pro Edition and Lite Edition 5.33 allow remote attackers to execute arbitrary SQL comm (no CVSS)
- [CVE-2005-4002](https://cve.now/CVE-2005-4002.md): WebEOC before 6.0.2 uses the same secret key for all installations, which allows attackers with the key to decrypt data from any WebEOC inst (no CVSS)
- [CVE-2005-4003](https://cve.now/CVE-2005-4003.md): Multiple SQL injection vulnerabilities in Absolute Shopping Package Solutions (ASPS) Shopping Cart Professional 2.9d and earlier, and Lite 2 (no CVSS)
- [CVE-2005-4004](https://cve.now/CVE-2005-4004.md): Cross-site scripting (XSS) vulnerability in search.asp in MyTemplateSite 1.2 and earlier allows remote attackers to inject arbitrary web scr (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2005-12-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.