# CVEs published 2007-01-25 28 CVEs were published on January 25, 2007: 0 critical, 0 high. Days are UTC. - [CVE-2007-0495](https://cve.now/CVE-2007-0495.md): PHP remote file inclusion vulnerability in include/config.inc.php in PhpSherpa allows remote attackers to execute arbitrary PHP code via a U (no CVSS) - [CVE-2007-0496](https://cve.now/CVE-2007-0496.md): PHP remote file inclusion vulnerability in lib/nl/nl.php in Neon Labs Website (nlws) 3.2 and earlier allows remote attackers to execute arbi (no CVSS) - [CVE-2007-0497](https://cve.now/CVE-2007-0497.md): PHP remote file inclusion vulnerability in upload/top.php in Upload-Service 1.0, when register\_globals is enabled, allows remote attackers t (no CVSS) - [CVE-2007-0498](https://cve.now/CVE-2007-0498.md): PHP remote file inclusion vulnerability in up.php in MySpeach 2.1 beta and possibly earlier allows remote attackers to execute arbitrary PHP (no CVSS) - [CVE-2007-0499](https://cve.now/CVE-2007-0499.md): PHP remote file inclusion vulnerability in config.php in Sangwan Kim phpIndexPage 1.0.1 and earlier allows remote attackers to execute arbit (no CVSS) - [CVE-2007-0500](https://cve.now/CVE-2007-0500.md): PHP remote file inclusion vulnerability in include/includes.php in Bradabra 2.0.5 and earlier allows remote attackers to execute arbitrary P (no CVSS) - [CVE-2007-0501](https://cve.now/CVE-2007-0501.md): PHP remote file inclusion vulnerability in index.php in Mafia Scum Tools 2.0.0 in Matthew Wardrop Advanced Random Generators (adv-random-gen (no CVSS) - [CVE-2007-0502](https://cve.now/CVE-2007-0502.md): SQL injection vulnerability in gallery.php in webSPELL 4.01.02 allows remote attackers to execute arbitrary SQL commands via the picID param (no CVSS) - [CVE-2007-0503](https://cve.now/CVE-2007-0503.md): Unspecified vulnerability in kcms\_calibrate in Sun Solaris 8 and 9 before 20071122 allows local users to execute arbitrary commands via unkn (no CVSS) - [CVE-2007-0493](https://cve.now/CVE-2007-0493.md): Use-after-free vulnerability in ISC BIND 9.3.0 up to 9.3.3, 9.4.0a1 up to 9.4.0a6, 9.4.0b1 up to 9.4.0b4, 9.4.0rc1, and 9.5.0a1 (Bind Forum (no CVSS) - [CVE-2007-0494](https://cve.now/CVE-2007-0494.md): ISC BIND 9.0.x, 9.1.x, 9.2.0 up to 9.2.7, 9.3.0 up to 9.3.3, 9.4.0a1 up to 9.4.0a6, 9.4.0b1 up to 9.4.0b4, 9.4.0rc1, and 9.5.0a1 (Bind Forum (no CVSS) - [CVE-2007-0476](https://cve.now/CVE-2007-0476.md): The gencert.sh script, when installing OpenLDAP before 2.1.30-r10, 2.2.x before 2.2.28-r7, and 2.3.x before 2.3.30-r2 as an ebuild in Gentoo (no CVSS) - [CVE-2007-0477](https://cve.now/CVE-2007-0477.md): Cross-site scripting (XSS) vulnerability in Openads 2.0.x before 2.0.10, 2.3 before 2.3.31 (aka Max Media Manager before 0.3.31-alpha-pr2), (no CVSS) - [CVE-2007-0478](https://cve.now/CVE-2007-0478.md): WebCore on Apple Mac OS X 10.3.9 and 10.4.10, as used in Safari, does not properly parse HTML comments in TITLE elements, which allows remot (no CVSS) - [CVE-2007-0479](https://cve.now/CVE-2007-0479.md): Memory leak in the TCP listener in Cisco IOS 9.x, 10.x, 11.x, and 12.x allows remote attackers to cause a denial of service by sending craft (no CVSS) - [CVE-2007-0480](https://cve.now/CVE-2007-0480.md): Cisco IOS 9.x, 10.x, 11.x, and 12.x and IOS XR 2.0.x, 3.0.x, and 3.2.x allows remote attackers to cause a denial of service or execute arbit (no CVSS) - [CVE-2007-0481](https://cve.now/CVE-2007-0481.md): Cisco IOS allows remote attackers to cause a denial of service (crash) via a crafted IPv6 Type 0 Routing header. (no CVSS) - [CVE-2007-0482](https://cve.now/CVE-2007-0482.md): cgi-bin/main in Sun Ray Server Software 2.0 and 3.0 before 20070123 allows local users to obtain the utadmin password by reading a web serve (no CVSS) - [CVE-2007-0483](https://cve.now/CVE-2007-0483.md): Multiple cross-site scripting (XSS) vulnerabilities in Enthusiast 3.1 allow remote attackers to inject arbitrary web script or HTML via the (no CVSS) - [CVE-2007-0484](https://cve.now/CVE-2007-0484.md): Multiple SQL injection vulnerabilities in Enthusiast 3.1 allow remote attackers to execute arbitrary SQL commands via the cat parameter to ( (no CVSS) - [CVE-2007-0485](https://cve.now/CVE-2007-0485.md): PHP remote file inclusion vulnerability in defines.php in WebChat 0.77 allows remote attackers to execute arbitrary PHP code via a URL in th (no CVSS) - [CVE-2007-0486](https://cve.now/CVE-2007-0486.md): Multiple PHP remote file inclusion vulnerabilities in Openads (aka phpAdsNew) 2.0.7 allow remote attackers to execute arbitrary PHP code via (no CVSS) - [CVE-2007-0487](https://cve.now/CVE-2007-0487.md): PHP remote file inclusion vulnerability in index.php in FreeForum 0.9.0 allows remote attackers to execute arbitrary PHP code via a URL in t (no CVSS) - [CVE-2007-0488](https://cve.now/CVE-2007-0488.md): The Huawei Versatile Routing Platform 1.43 2500E-003 firmware on the Quidway R1600 Router, and possibly other models, allows remote attacker (no CVSS) - [CVE-2007-0489](https://cve.now/CVE-2007-0489.md): PHP remote file inclusion vulnerability in includes/functions.visohotlink.php in VisoHotlink 1.01 and possibly earlier allows remote attacke (no CVSS) - [CVE-2007-0490](https://cve.now/CVE-2007-0490.md): index.php in Open-Realty 2.3.4 allows remote attackers to obtain sensitive information (the full path) via an invalid listingID parameter in (no CVSS) - [CVE-2007-0491](https://cve.now/CVE-2007-0491.md): PHP remote file inclusion vulnerability in up.php in Sky GUNNING MySpeach 3.0.6 and earlier allows remote attackers to execute arbitrary PHP (no CVSS) - [CVE-2007-0492](https://cve.now/CVE-2007-0492.md): Multiple SQL injection vulnerabilities in gallery.php in webSPELL 4.01.02 and earlier allow remote attackers to execute arbitrary SQL comman (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2007-01-25 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.