# CVEs published 2009-02-24

25 CVEs were published on February 24, 2009: 0 critical, 0 high. Days are UTC.

- [CVE-2009-0726](https://cve.now/CVE-2009-0726.md): SQL injection vulnerability in the GigCalendar (com\_gigcal) component 1.0 for Mambo and Joomla! allows remote attackers to execute arbitrary (no CVSS)
- [CVE-2009-0727](https://cve.now/CVE-2009-0727.md): SQL injection vulnerability in jobdetails.php in taifajobs 1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the (no CVSS)
- [CVE-2009-0728](https://cve.now/CVE-2009-0728.md): SQL injection vulnerability in the My\_eGallery module for MAXdev MDPro (MD-Pro) and Postnuke allows remote attackers to execute arbitrary SQ (no CVSS)
- [CVE-2009-0729](https://cve.now/CVE-2009-0729.md): Multiple directory traversal vulnerabilities in Page Engine CMS 2.0 Basic and Pro allow remote attackers to include and execute arbitrary lo (no CVSS)
- [CVE-2009-0730](https://cve.now/CVE-2009-0730.md): Multiple SQL injection vulnerabilities in the GigCalendar (com\_gigcal) component 1.0 for Mambo and Joomla!, when magic\_quotes\_gpc is disable (no CVSS)
- [CVE-2009-0731](https://cve.now/CVE-2009-0731.md): Directory traversal vulnerability in pages/play.php in Free Arcade Script 1.0 allows remote attackers to include and execute arbitrary local (no CVSS)
- [CVE-2009-0732](https://cve.now/CVE-2009-0732.md): Downloadcenter 2.1 stores common.h under the web root with insufficient access control, which allows remote attackers to obtain user credent (no CVSS)
- [CVE-2008-6251](https://cve.now/CVE-2008-6251.md): PHP remote file inclusion vulnerability in includes/init.php in phpFan 3.3.4 allows remote attackers to execute arbitrary PHP code via a URL (no CVSS)
- [CVE-2008-6252](https://cve.now/CVE-2008-6252.md): Stack-based buffer overflow in the smc program in smcFanControl 2.1.2 allows local users to execute arbitrary code and gain privileges via a (no CVSS)
- [CVE-2008-6253](https://cve.now/CVE-2008-6253.md): Directory traversal vulnerability in data/inc/lib/pcltar.lib.php in Pluck 4.5.3, when register\_globals is enabled, allows remote attackers t (no CVSS)
- [CVE-2008-6254](https://cve.now/CVE-2008-6254.md): SQL injection vulnerability in scripts/documents.php in Jadu Galaxies allows remote attackers to execute arbitrary SQL commands via the cate (no CVSS)
- [CVE-2008-6255](https://cve.now/CVE-2008-6255.md): Multiple SQL injection vulnerabilities in vBulletin 3.7.4 allow remote authenticated administrators to execute arbitrary SQL commands via th (no CVSS)
- [CVE-2008-6256](https://cve.now/CVE-2008-6256.md): SQL injection vulnerability in admincp/admincalendar.php in vBulletin 3.7.3.pl1 allows remote authenticated administrators to execute arbitr (no CVSS)
- [CVE-2008-6257](https://cve.now/CVE-2008-6257.md): SQL injection vulnerability in default.asp in Openasp 3.0 and earlier allows remote attackers to execute arbitrary SQL commands via the idpa (no CVSS)
- [CVE-2008-6258](https://cve.now/CVE-2008-6258.md): SQL injection vulnerability in users.asp in QuadComm Q-Shop 3.0, and possibly earlier, allows remote attackers to execute arbitrary SQL comm (no CVSS)
- [CVE-2008-6259](https://cve.now/CVE-2008-6259.md): Cross-site scripting (XSS) vulnerability in search.asp in QuadComm Q-Shop 3.0, and possibly earlier, allows remote attackers to inject arbit (no CVSS)
- [CVE-2008-6260](https://cve.now/CVE-2008-6260.md): SQL injection vulnerability in index.php in Ultrastats 0.2.144 and 0.3.11 allows remote attackers to execute arbitrary SQL commands via the (no CVSS)
- [CVE-2008-6261](https://cve.now/CVE-2008-6261.md): SQL injection vulnerability in view.php in E-topbiz AdManager 4 allows remote attackers to execute arbitrary SQL commands via the group para (no CVSS)
- [CVE-2008-6262](https://cve.now/CVE-2008-6262.md): SQL injection vulnerability in lib/url/meta\_url.php in SaturnCMS allows remote attackers to execute arbitrary SQL commands via the URL to th (no CVSS)
- [CVE-2008-6263](https://cve.now/CVE-2008-6263.md): SQL injection vulnerability in lib/user/t\_user.php in SaturnCMS allows remote attackers to execute arbitrary SQL commands via the username p (no CVSS)
- [CVE-2008-6264](https://cve.now/CVE-2008-6264.md): SQL injection vulnerability in admin/admin.php in E-topbiz Slide Popups 1.0 allows remote attackers to execute arbitrary SQL commands via th (no CVSS)
- [CVE-2008-6265](https://cve.now/CVE-2008-6265.md): Directory traversal vulnerability in portfolio/css.php in Cyberfolio 7.12.2 and earlier allows remote attackers to include and execute arbit (no CVSS)
- [CVE-2009-0722](https://cve.now/CVE-2009-0722.md): Directory traversal vulnerability in admin.php in Potato News 1.0.0 allows remote attackers to include and execute arbitrary files via a .. (no CVSS)
- [CVE-2007-5289](https://cve.now/CVE-2007-5289.md): HP Mercury Quality Center (QC) 9.2 and earlier, and possibly TestDirector, relies on cached client-side scripts to implement "workflow" and (no CVSS)
- [CVE-2009-0439](https://cve.now/CVE-2009-0439.md): Unspecified vulnerability in the queue manager in IBM WebSphere MQ (WMQ) 5.3, 6.0 before 6.0.2.6, and 7.0 before 7.0.0.2 allows local users (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2009-02-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.