# CVEs published 2009-02-25

36 CVEs were published on February 25, 2009: 0 critical, 1 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2008-6274](https://cve.now/CVE-2008-6274.md): Multiple SQL injection vulnerabilities in index.php in FamilyProject 2.0 allow remote attackers to execute arbitrary SQL commands via (1) th (no CVSS)
- [CVE-2008-6275](https://cve.now/CVE-2008-6275.md): Cross-site scripting (XSS) vulnerability in the User Karma module 5.x before 5.x-1.13 and 6.x before 6.x-1.0-beta1, a module for Drupal, all (no CVSS)
- [CVE-2008-6276](https://cve.now/CVE-2008-6276.md): Multiple SQL injection vulnerabilities in the User Karma module 5.x before 5.x-1.13 and 6.x before 6.x-1.0-beta1, a module for Drupal, allow (no CVSS)
- [CVE-2008-6277](https://cve.now/CVE-2008-6277.md): SQL injection vulnerability in product.php in RakhiSoftware Price Comparison Script (aka Shopping Cart) allows remote attackers to execute a (no CVSS)
- [CVE-2008-6278](https://cve.now/CVE-2008-6278.md): Multiple cross-site scripting (XSS) vulnerabilities in product.php in RakhiSoftware Price Comparison Script (aka Shopping Cart) allow remote (no CVSS)
- [CVE-2008-6279](https://cve.now/CVE-2008-6279.md): RakhiSoftware Price Comparison Script (aka Shopping Cart) allows remote attackers to obtain sensitive information via an invalid PHPSESSID c (no CVSS)
- [CVE-2008-6280](https://cve.now/CVE-2008-6280.md): Cross-site scripting (XSS) vulnerability in apply.cgi on the Linksys WRT160N allows remote attackers to inject arbitrary web script or HTML (no CVSS)
- [CVE-2008-6281](https://cve.now/CVE-2008-6281.md): SQL injection vulnerability in index.php in Bluo CMS 1.2 allows remote attackers to execute arbitrary SQL commands via the id parameter. (no CVSS)
- [CVE-2008-6282](https://cve.now/CVE-2008-6282.md): SQL injection vulnerability in engine/users/users\_edit\_pub.inc in CMS Ortus 1.13 and earlier allows remote authenticated users to execute ar (no CVSS)
- [CVE-2008-6283](https://cve.now/CVE-2008-6283.md): Cross-site scripting (XSS) vulnerability in Subtext 2.0 allows remote attackers to inject arbitrary web script or HTML via a comment, relate (no CVSS)
- [CVE-2008-6284](https://cve.now/CVE-2008-6284.md): SQL injection vulnerability in edit.php in Z1Exchange 1.0 allows remote attackers to execute arbitrary SQL commands via the site parameter. (no CVSS)
- [CVE-2008-6285](https://cve.now/CVE-2008-6285.md): SQL injection vulnerability in index.php in PHP TV Portal 2.0 and earlier allows remote attackers to execute arbitrary SQL commands via the (no CVSS)
- [CVE-2008-6286](https://cve.now/CVE-2008-6286.md): Multiple SQL injection vulnerabilities in SubscriberStart.asp in Active Newsletter 4.3 allow remote attackers to execute arbitrary SQL comma (no CVSS)
- [CVE-2008-6287](https://cve.now/CVE-2008-6287.md): Multiple PHP remote file inclusion vulnerabilities in Broadcast Machine 0.1 allow remote attackers to execute arbitrary PHP code via a URL i (no CVSS)
- [CVE-2008-6288](https://cve.now/CVE-2008-6288.md): Directory traversal vulnerability in download.php in Interface Medien ibase 2.03 and earlier allows remote attackers to read arbitrary files (no CVSS)
- [CVE-2009-0734](https://cve.now/CVE-2009-0734.md): Heap-based buffer overflow in MultimediaPlayer.exe 6.86.240.7 in Nokia PC Suite 6.86.9.3 allows remote attackers to execute arbitrary code v (no CVSS)
- [CVE-2009-0735](https://cve.now/CVE-2009-0735.md): Directory traversal vulnerability in lib/classes/message\_class.php in Papoo CMS 3.6, when register\_globals is enabled and magic\_quotes\_gpc i (no CVSS)
- [CVE-2009-0736](https://cve.now/CVE-2009-0736.md): Cross-site scripting (XSS) vulnerability in Pebble before 2.3.2 allows remote attackers to inject arbitrary web script or HTML via unspecifi (no CVSS)
- [CVE-2009-0737](https://cve.now/CVE-2009-0737.md): Multiple cross-site scripting (XSS) vulnerabilities in the web-based installer (config/index.php) in MediaWiki 1.6 before 1.6.12, 1.12 befor (no CVSS)
- [CVE-2009-0738](https://cve.now/CVE-2009-0738.md): SQL injection vulnerability in login.php in Auth Php 1.0 allows remote attackers to execute arbitrary SQL commands via the (1) username and (no CVSS)
- [CVE-2009-0739](https://cve.now/CVE-2009-0739.md): SQL injection vulnerability in login.php in MyNews 0.10 allows remote attackers to execute arbitrary SQL commands via the (1) username and ( (no CVSS)
- [CVE-2009-0740](https://cve.now/CVE-2009-0740.md): SQL injection vulnerability in login.php in BlueBird Prelease allows remote attackers to execute arbitrary SQL commands via the (1) username (no CVSS)
- [CVE-2009-0741](https://cve.now/CVE-2009-0741.md): SQL injection vulnerability in Login.asp in Craft Silicon Banking@Home 2.1 and earlier allows remote attackers to execute arbitrary SQL comm (no CVSS)
- [CVE-2008-6272](https://cve.now/CVE-2008-6272.md): SQL injection vulnerability in admin/index.php in Dragan Mitic Apoll 0.7 beta and 0.7.5 allows remote attackers to execute arbitrary SQL com (no CVSS)
- [CVE-2008-6273](https://cve.now/CVE-2008-6273.md): Directory traversal vulnerability in configuration\_script.php in MyKtools 3.0 allows remote authenticated administrators to include and exec (no CVSS)
- [CVE-2009-0238](https://cve.now/CVE-2009-0238.md): Microsoft Office Excel 2000 SP3, 2002 SP3, 2003 SP3, and 2007 SP1; Excel Viewer 2003 Gold and SP3; Excel Viewer; Compatibility Pack for Word (CVSS 8.8, KEV)
- [CVE-2009-0505](https://cve.now/CVE-2009-0505.md): The CICS listener in IBM TXSeries for Multiplatforms 6.2 GA waits for a forcepurge acknowledgement from the CICS Application Server (CICSAS) (no CVSS)
- [CVE-2009-0506](https://cve.now/CVE-2009-0506.md): Unspecified vulnerability in IBM WebSphere Application Server (WAS) 5.1 and 6.0.2 before 6.0.2.33 on z/OS, when CSIv2 Identity Assertion is (no CVSS)
- [CVE-2009-0540](https://cve.now/CVE-2009-0540.md): Cross-site scripting (XSS) vulnerability in Libero 5.3 SP5, and possibly other versions before 5.5 SP1, allows remote attackers to inject ar (no CVSS)
- [CVE-2009-0541](https://cve.now/CVE-2009-0541.md): Multiple cross-site scripting (XSS) vulnerabilities in Magento 1.2.0 and 1.2.1.1 allow remote attackers to inject arbitrary web script or HT (no CVSS)
- [CVE-2008-6266](https://cve.now/CVE-2008-6266.md): SQL injection vulnerability in links.php in Appalachian State University phpWebSite allows remote attackers to execute arbitrary SQL command (no CVSS)
- [CVE-2008-6267](https://cve.now/CVE-2008-6267.md): Cross-site scripting (XSS) vulnerability in detail.php in Multi Languages WebShop Online 1.02 allows remote attackers to inject arbitrary we (no CVSS)
- [CVE-2008-6268](https://cve.now/CVE-2008-6268.md): SQL injection vulnerability in detail.php in WEBBDOMAIN Multi Languages WebShop Online 1.02 allows remote attackers to execute arbitrary SQL (no CVSS)
- [CVE-2008-6269](https://cve.now/CVE-2008-6269.md): Joovili 3.1.4 allows remote attackers to bypass authentication and gain privileges as other users, including the administrator, by setting t (no CVSS)
- [CVE-2008-6270](https://cve.now/CVE-2008-6270.md): SQL injection vulnerability in admin/index.php in Dragan Mitic Apoll 0.7 beta and 0.7.5 allows remote attackers to execute arbitrary SQL com (no CVSS)
- [CVE-2008-6271](https://cve.now/CVE-2008-6271.md): Directory traversal vulnerability in index.php in TBmnetCMS 1.0, when magic\_quotes\_gpc is disabled, allows remote attackers to read arbitrar (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2009-02-25
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.