# CVEs published 2007-04-26

40 CVEs were published on April 26, 2007: 0 critical, 0 high. Days are UTC.

- [CVE-2007-2298](https://cve.now/CVE-2007-2298.md): Multiple PHP remote file inclusion vulnerabilities in Garennes 0.6.1 and earlier allow remote attackers to execute arbitrary PHP code via a (no CVSS)
- [CVE-2007-2299](https://cve.now/CVE-2007-2299.md): Multiple SQL injection vulnerabilities in Frogss CMS 0.7 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) dz (no CVSS)
- [CVE-2007-2300](https://cve.now/CVE-2007-2300.md): Multiple cross-site scripting (XSS) vulnerabilities in Endy Kristanto Surat kabar / News Management Online (aka phpwebnews) 0.2 and earlier (no CVSS)
- [CVE-2007-2301](https://cve.now/CVE-2007-2301.md): Multiple PHP remote file inclusion vulnerabilities in audioCMS arash 0.1.4 allow remote attackers to execute arbitrary PHP code via a URL in (no CVSS)
- [CVE-2007-2302](https://cve.now/CVE-2007-2302.md): PHP remote file inclusion vulnerability in autoindex.php in Expow 0.8 allows remote attackers to execute arbitrary PHP code via a URL in the (no CVSS)
- [CVE-2007-2303](https://cve.now/CVE-2007-2303.md): Directory traversal vulnerability in includes/footer.php in News Manager Deluxe (NMDeluxe) 1.0.1 allows remote attackers to include and exec (no CVSS)
- [CVE-2007-2304](https://cve.now/CVE-2007-2304.md): Multiple directory traversal vulnerabilities in Quick and Dirty Blog (QDBlog) 0.4, and possibly earlier, allow remote attackers to include a (no CVSS)
- [CVE-2007-2305](https://cve.now/CVE-2007-2305.md): Multiple SQL injection vulnerabilities in authenticate.php in Quick and Dirty Blog (QDBlog) 0.4, and possibly earlier, allow remote attacker (no CVSS)
- [CVE-2007-2306](https://cve.now/CVE-2007-2306.md): Multiple cross-site scripting (XSS) vulnerabilities in the Virtual War (VWar) 1.5.0 R15 and earlier module for PHP-Nuke, when register\_globa (no CVSS)
- [CVE-2007-2307](https://cve.now/CVE-2007-2307.md): PHP remote file inclusion vulnerability in engine/engine.inc.php in WebKalk2 1.9.0 allows remote attackers to execute arbitrary PHP code via (no CVSS)
- [CVE-2007-2308](https://cve.now/CVE-2007-2308.md): Cross-site scripting (XSS) vulnerability in cas.php in FloweRS 2.0 allows remote attackers to inject arbitrary web script or HTML via the ro (no CVSS)
- [CVE-2007-2309](https://cve.now/CVE-2007-2309.md): Cross-site scripting (XSS) vulnerability in cas.php in FloweRS 2.0 allows remote attackers to inject arbitrary web script or HTML via the de (no CVSS)
- [CVE-2007-2310](https://cve.now/CVE-2007-2310.md): Cross-site scripting (XSS) vulnerability in plugins/spaw/img\_popup.php in BloofoxCMS 0.2.2 allows remote attackers to inject arbitrary web s (no CVSS)
- [CVE-2007-2311](https://cve.now/CVE-2007-2311.md): PHP remote file inclusion vulnerability in install/index.php in BlooFoxCMS 0.2.2 allows remote attackers to execute arbitrary PHP code via a (no CVSS)
- [CVE-2007-2312](https://cve.now/CVE-2007-2312.md): Multiple SQL injection vulnerabilities in the Virtual War (VWar) 1.5.0 R15 module for PHP-Nuke allow remote attackers to execute arbitrary S (no CVSS)
- [CVE-2007-2313](https://cve.now/CVE-2007-2313.md): PHP remote file inclusion vulnerability in getinfo1.php in the Shotcast 1.0 RC2 module for mxBB allows remote attackers to execute arbitrary (no CVSS)
- [CVE-2007-2314](https://cve.now/CVE-2007-2314.md): Multiple SQL injection vulnerabilities in Crea-Book 1.0, and possibly earlier, when magic\_quotes\_gpc is disabled, allow remote attackers to (no CVSS)
- [CVE-2007-2315](https://cve.now/CVE-2007-2315.md): MiniShare 1.5.4, and possibly earlier, allows remote attackers to cause a denial of service (application crash) via a flood of requests for (no CVSS)
- [CVE-2007-2316](https://cve.now/CVE-2007-2316.md): Unspecified vulnerability in the admin script in Open Business Management (OBM) before 2.0.0 allows remote attackers to have an unknown impa (no CVSS)
- [CVE-2007-2317](https://cve.now/CVE-2007-2317.md): Multiple PHP remote file inclusion vulnerabilities in MiniBB Forum 1.5a and earlier, as used by TOSMO/Mambo 4.0.12 and probably other produc (no CVSS)
- [CVE-2007-2318](https://cve.now/CVE-2007-2318.md): Multiple format string vulnerabilities in FileZilla before 2.2.32 allow remote attackers to execute arbitrary code via format string specifi (no CVSS)
- [CVE-2007-2319](https://cve.now/CVE-2007-2319.md): PHP remote file inclusion vulnerability in the AutoStand 1.1 and earlier module for Joomla! allows remote attackers to execute arbitrary PHP (no CVSS)
- [CVE-2007-2320](https://cve.now/CVE-2007-2320.md): SQL injection vulnerability in kontakt.php in Papoo 3.02 and earlier allows remote attackers to execute arbitrary SQL commands via the menui (no CVSS)
- [CVE-2007-1683](https://cve.now/CVE-2007-1683.md): Stack-based buffer overflow in the DoWebMenuAction function in the IncrediMail IMMenuShellExt ActiveX control (ImShExt.dll) allows remote at (no CVSS)
- [CVE-2007-2291](https://cve.now/CVE-2007-2291.md): CRLF injection vulnerability in the Digest Authentication support for Microsoft Internet Explorer 7.0.5730.11 allows remote attackers to con (no CVSS)
- [CVE-2007-2292](https://cve.now/CVE-2007-2292.md): CRLF injection vulnerability in the Digest Authentication support for Mozilla Firefox before 2.0.0.8 and SeaMonkey before 1.1.5 allows remot (no CVSS)
- [CVE-2007-2293](https://cve.now/CVE-2007-2293.md): Multiple stack-based buffer overflows in the process\_sdp function in chan\_sip.c of the SIP channel T.38 SDP parser in Asterisk before 1.4.3 (no CVSS)
- [CVE-2007-2294](https://cve.now/CVE-2007-2294.md): The Manager Interface in Asterisk before 1.2.18 and 1.4.x before 1.4.3 allows remote attackers to cause a denial of service (crash) by using (no CVSS)
- [CVE-2007-2295](https://cve.now/CVE-2007-2295.md): Heap-based buffer overflow in the JVTCompEncodeFrame function in Apple Quicktime 7.1.5 and other versions before 7.2 allows remote attackers (no CVSS)
- [CVE-2007-2296](https://cve.now/CVE-2007-2296.md): Integer overflow in the FlipFileTypeAtom\_BtoN function in Apple Quicktime 7.1.5, and other versions before 7.2, allows remote attackers to e (no CVSS)
- [CVE-2007-2297](https://cve.now/CVE-2007-2297.md): The SIP channel driver (chan\_sip) in Asterisk before 1.2.18 and 1.4.x before 1.4.3 does not properly parse SIP UDP packets that do not conta (no CVSS)
- [CVE-2007-2282](https://cve.now/CVE-2007-2282.md): Cisco Network Services (CNS) NetFlow Collection Engine (NFC) before 6.0 has an nfcuser account with the default password nfcuser, which allo (no CVSS)
- [CVE-2007-2283](https://cve.now/CVE-2007-2283.md): Buffer overflow in Fresh View 7.15 allows user-assisted remote attackers to execute arbitrary code via a crafted .PSP file. (no CVSS)
- [CVE-2007-2284](https://cve.now/CVE-2007-2284.md): Buffer overflow in ABC-View Manager 1.42 allows user-assisted remote attackers to execute arbitrary code via a crafted .PSP file. (no CVSS)
- [CVE-2007-2285](https://cve.now/CVE-2007-2285.md): Directory traversal vulnerability in examples/layout/feed-proxy.php in Jack Slocum Ext 1.0 alpha1 (Ext JS) allows remote attackers to read a (no CVSS)
- [CVE-2007-2286](https://cve.now/CVE-2007-2286.md): PHP remote file inclusion vulnerability in config.php in Built2Go PHP Link Portal 1.79 allows remote attackers to execute arbitrary PHP code (no CVSS)
- [CVE-2007-2287](https://cve.now/CVE-2007-2287.md): PHP remote file inclusion vulnerability in accept.php in comus 2.0 Final allows remote attackers to execute arbitrary PHP code via a URL in (no CVSS)
- [CVE-2007-2288](https://cve.now/CVE-2007-2288.md): PHP remote file inclusion vulnerability in info.php in Doruk100.net doruk100net allows remote attackers to execute arbitrary PHP code via a (no CVSS)
- [CVE-2007-2289](https://cve.now/CVE-2007-2289.md): PHP remote file inclusion vulnerability in admin/includes/spaw/dialogs/insert\_link.php in download engine (Download-Engine) 1.4.1 allows rem (no CVSS)
- [CVE-2007-2290](https://cve.now/CVE-2007-2290.md): Multiple PHP remote file inclusion vulnerabilities in B2 Weblog and News Publishing Tool 0.6.1 allow remote attackers to execute arbitrary P (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2007-04-26
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.