# CVEs published 2007-03-23 29 CVEs were published on March 23, 2007: 0 critical, 0 high. Days are UTC. - [CVE-2007-1638](https://cve.now/CVE-2007-1638.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the check\_csrftoken function in lib/lib.inc.php in PHProjekt 5.2.0, when magic (no CVSS) - [CVE-2007-1639](https://cve.now/CVE-2007-1639.md): Unrestricted file upload vulnerability in PHProjekt 5.2.0, when magic\_quotes\_gpc is disabled, allows remote authenticated users to upload an (no CVSS) - [CVE-2007-1640](https://cve.now/CVE-2007-1640.md): Multiple PHP remote file inclusion vulnerabilities in ClassWeb 2.03 and earlier allow remote attackers to execute arbitrary PHP code via a U (no CVSS) - [CVE-2007-1641](https://cve.now/CVE-2007-1641.md): SQL injection vulnerability in index.php in PortailPHP 2.0 allows remote attackers to execute arbitrary SQL commands via the idnews paramete (no CVSS) - [CVE-2007-1634](https://cve.now/CVE-2007-1634.md): Variable extraction vulnerability in grab\_globals.php in Net Portal Dynamic System (NPDS) 5.10 and earlier allows remote attackers to conduc (no CVSS) - [CVE-2007-1635](https://cve.now/CVE-2007-1635.md): Static code injection vulnerability in admin/settings.php in Net Portal Dynamic System (NPDS) 5.10 and earlier allows remote authenticated u (no CVSS) - [CVE-2007-1636](https://cve.now/CVE-2007-1636.md): Directory traversal vulnerability in index.php in RoseOnlineCMS 3 B1 allows remote attackers to include arbitrary files via a .. (no CVSS) - [CVE-2007-1637](https://cve.now/CVE-2007-1637.md): Multiple buffer overflows in the IMAILAPILib ActiveX control (IMailAPI.dll) in Ipswitch IMail Server before 2006.2 allow remote attackers to (no CVSS) - [CVE-2007-1623](https://cve.now/CVE-2007-1623.md): Multiple cross-site scripting (XSS) vulnerabilities in realGuestbook 5.01, when register\_globals is enabled, allow remote attackers to injec (no CVSS) - [CVE-2007-1624](https://cve.now/CVE-2007-1624.md): Multiple SQL injection vulnerabilities in realGuestbook 5.01 allow remote attackers to execute arbitrary SQL commands via the (1) name, (2) (no CVSS) - [CVE-2007-1625](https://cve.now/CVE-2007-1625.md): Cross-site scripting (XSS) vulnerability in save\_entry.php in realGuestbook 5.01 allows remote attackers to inject arbitrary web script or H (no CVSS) - [CVE-2007-1626](https://cve.now/CVE-2007-1626.md): PHP remote file inclusion vulnerability in iframe.php in the iFrame Module for PHP-NUKE allows remote attackers to execute arbitrary PHP cod (no CVSS) - [CVE-2007-1628](https://cve.now/CVE-2007-1628.md): Multiple PHP remote file inclusion vulnerabilities in Study planner (Studiewijzer) 0.15 and earlier, when register\_globals is enabled, allow (no CVSS) - [CVE-2007-1629](https://cve.now/CVE-2007-1629.md): SQL injection vulnerability in default.asp in ActiveWebSoftwares Active Photo Gallery allows remote attackers to execute arbitrary SQL comma (no CVSS) - [CVE-2007-1630](https://cve.now/CVE-2007-1630.md): SQL injection vulnerability in default.asp in ActiveWebSoftwares Active Link Engine allows remote attackers to execute arbitrary SQL command (no CVSS) - [CVE-2007-1631](https://cve.now/CVE-2007-1631.md): PHP remote file inclusion vulnerability in signup.php in CLBOX 1.01 allows remote attackers to execute arbitrary PHP code via a URL in the h (no CVSS) - [CVE-2007-1632](https://cve.now/CVE-2007-1632.md): Unspecified vulnerability in TYPOlight webCMS before 2.2 Build 5 has unknown impact and attack vectors related to a "major security hole." (no CVSS) - [CVE-2007-1633](https://cve.now/CVE-2007-1633.md): Directory traversal vulnerability in bbcode\_ref.php in the Giorgio Ciranni Splatt Forum 4.0 RC1 module for PHP-Nuke allows remote attackers (no CVSS) - [CVE-2007-1612](https://cve.now/CVE-2007-1612.md): SQL injection vulnerability in index.php in Katalog Plyt Audio 1.0 and earlier allows remote attackers to execute arbitrary SQL commands via (no CVSS) - [CVE-2007-1613](https://cve.now/CVE-2007-1613.md): Directory traversal vulnerability in view.php in MPM Chat 2.5 allows remote attackers to include and execute arbitrary local files via a .. (no CVSS) - [CVE-2007-1614](https://cve.now/CVE-2007-1614.md): Stack-based buffer overflow in the zzip\_open\_shared\_io function in zzip/file.c in ZZIPlib Library before 0.13.49 allows user-assisted remote (no CVSS) - [CVE-2007-1615](https://cve.now/CVE-2007-1615.md): SQL injection vulnerability in index.php in ScriptMagix Jokes 2.0 and earlier allows remote attackers to execute arbitrary SQL commands via (no CVSS) - [CVE-2007-1616](https://cve.now/CVE-2007-1616.md): SQL injection vulnerability in index.php in ScriptMagix Lyrics 2.0 and earlier allows remote attackers to execute arbitrary SQL commands via (no CVSS) - [CVE-2007-1617](https://cve.now/CVE-2007-1617.md): SQL injection vulnerability in index.php in ScriptMagix Recipes 2.0 and earlier allows remote attackers to execute arbitrary SQL commands vi (no CVSS) - [CVE-2007-1618](https://cve.now/CVE-2007-1618.md): SQL injection vulnerability in index.php in ScriptMagix FAQ Builder 2.0 and earlier allows remote attackers to execute arbitrary SQL command (no CVSS) - [CVE-2007-1619](https://cve.now/CVE-2007-1619.md): SQL injection vulnerability in viewcomments.php in ScriptMagix Photo Rating 2.0 and earlier allows remote attackers to execute arbitrary SQL (no CVSS) - [CVE-2007-1620](https://cve.now/CVE-2007-1620.md): Multiple PHP remote file inclusion vulnerabilities in PHP DB Designer 1.02 and earlier allow remote attackers to execute arbitrary PHP code (no CVSS) - [CVE-2007-1621](https://cve.now/CVE-2007-1621.md): PHP remote file inclusion vulnerability in templates/head.php in Active PHP Bookmark Notes (APB) 0.2.5 and earlier allows remote attackers t (no CVSS) - [CVE-2007-1622](https://cve.now/CVE-2007-1622.md): Cross-site scripting (XSS) vulnerability in wp-admin/vars.php in WordPress before 2.0.10 RC2, and before 2.1.3 RC2 in the 2.1 series, allows (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2007-03-23 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.