# CVEs published 2008-10-28

21 CVEs were published on October 28, 2008: 0 critical, 0 high. Days are UTC.

- [CVE-2008-4772](https://cve.now/CVE-2008-4772.md): SQL injection vulnerability in main/main.php in QuestCMS allows remote attackers to execute arbitrary SQL commands via the obj parameter. (no CVSS)
- [CVE-2008-4773](https://cve.now/CVE-2008-4773.md): Directory traversal vulnerability in main/main.php in QuestCMS allows remote attackers to read arbitrary local files via a .. (no CVSS)
- [CVE-2008-4774](https://cve.now/CVE-2008-4774.md): Cross-site scripting (XSS) vulnerability in main/main.php in QuestCMS allows remote attackers to inject arbitrary web script or HTML via the (no CVSS)
- [CVE-2008-4775](https://cve.now/CVE-2008-4775.md): Cross-site scripting (XSS) vulnerability in pmd\_pdf.php in phpMyAdmin 3.0.0, and possibly other versions including 2.11.9.2 and 3.0.1, when (no CVSS)
- [CVE-2008-4776](https://cve.now/CVE-2008-4776.md): libgadu before 1.8.2 allows remote servers to cause a denial of service (crash) via a contact description with a large length, which trigger (no CVSS)
- [CVE-2008-4771](https://cve.now/CVE-2008-4771.md): Stack-based buffer overflow in VATDecoder.VatCtrl.1 ActiveX control in (1) 4xem VatCtrl Class (VATDecoder.dll 1.0.0.27 and 1.0.0.51), (2) D- (no CVSS)
- [CVE-2008-4767](https://cve.now/CVE-2008-4767.md): Unrestricted file upload vulnerability in the DownloadsPlus module in PHP-Nuke allows remote attackers to execute arbitrary code by uploadin (no CVSS)
- [CVE-2008-4768](https://cve.now/CVE-2008-4768.md): SQL injection vulnerability in TLM CMS 3.1 allows remote attackers to execute arbitrary SQL commands via the nom parameter to a-b-membres.ph (no CVSS)
- [CVE-2008-4769](https://cve.now/CVE-2008-4769.md): Directory traversal vulnerability in the get\_category\_template function in wp-includes/theme.php in WordPress 2.3.3 and earlier, and 2.5, al (no CVSS)
- [CVE-2008-4763](https://cve.now/CVE-2008-4763.md): Multiple cross-site scripting (XSS) vulnerabilities in sample.php in WiKID wClient-PHP 3.0-2 and earlier allow remote attackers to inject ar (no CVSS)
- [CVE-2008-4764](https://cve.now/CVE-2008-4764.md): Directory traversal vulnerability in the eXtplorer module (com\_extplorer) 2.0.0 RC2 and earlier in Joomla! allows remote attackers to read a (no CVSS)
- [CVE-2008-4765](https://cve.now/CVE-2008-4765.md): SQL injection vulnerability in pollBooth.php in osCommerce Poll Booth Add-On 2.0 allows remote attackers to execute arbitrary SQL commands v (no CVSS)
- [CVE-2008-4766](https://cve.now/CVE-2008-4766.md): SQL injection vulnerability in member.php in Oxygen Bulletin Board 1.1.3 allows remote attackers to execute arbitrary SQL commands via the m (no CVSS)
- [CVE-2008-4755](https://cve.now/CVE-2008-4755.md): SQL injection vulnerability in gotourl.php in PozScripts Classified Auctions Script allows remote attackers to execute arbitrary SQL command (no CVSS)
- [CVE-2008-4756](https://cve.now/CVE-2008-4756.md): Cross-site scripting (XSS) vulnerability in add\_prest\_date.php in PHP-Daily allows remote attackers to inject arbitrary web script or HTML v (no CVSS)
- [CVE-2008-4757](https://cve.now/CVE-2008-4757.md): Multiple SQL injection vulnerabilities in PHP-Daily allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to (a) (no CVSS)
- [CVE-2008-4758](https://cve.now/CVE-2008-4758.md): Directory traversal vulnerability in download\_file.php in PHP-Daily allows remote attackers to read arbitrary local files via a .. (no CVSS)
- [CVE-2008-4759](https://cve.now/CVE-2008-4759.md): Directory traversal vulnerability in download.php in BuzzyWall 1.3.1 allows remote attackers to read arbitrary local files via a .. (no CVSS)
- [CVE-2008-4760](https://cve.now/CVE-2008-4760.md): SQL injection vulnerability in lecture.php in Graphiks MyForum 1.3, when register\_globals is enabled, allows remote attackers to execute arb (no CVSS)
- [CVE-2008-4761](https://cve.now/CVE-2008-4761.md): Cross-site scripting (XSS) vulnerability in includes/htmlArea/plugins/HtmlTidy/html-tidy-logic.php in Kayako eSupport 3.20.2 allows remote a (no CVSS)
- [CVE-2008-4762](https://cve.now/CVE-2008-4762.md): Stack-based buffer overflow in freeSSHd 1.2.1 allows remote authenticated users to cause a denial of service (service crash) and potentially (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2008-10-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.