# CVEs published 2009-05-01

33 CVEs were published on May 1, 2009: 0 critical, 0 high. Days are UTC.

- [CVE-2009-1512](https://cve.now/CVE-2009-1512.md): Static code injection vulnerability in X-Forum 0.6.2 allows remote authenticated administrators to inject arbitrary PHP code into Config.php (no CVSS)
- [CVE-2008-6785](https://cve.now/CVE-2008-6785.md): Unrestricted file upload vulnerability in Mini File Host 1.5 allows remote attackers to execute arbitrary code by uploading a file with an e (no CVSS)
- [CVE-2008-6786](https://cve.now/CVE-2008-6786.md): Multiple directory traversal vulnerabilities in geekigeeki.py in GeekiGeeki before 3.0 allow remote attackers to read arbitrary files via di (no CVSS)
- [CVE-2008-6787](https://cve.now/CVE-2008-6787.md): SQL injection vulnerability in administrator/index.php in Lizardware CMS 0.6.0 and earlier allows remote attackers to execute arbitrary SQL (no CVSS)
- [CVE-2009-1508](https://cve.now/CVE-2009-1508.md): SQL injection vulnerability in the xforum\_validateUser function in Common.php in X-Forum 0.6.2 allows remote attackers to execute arbitrary (no CVSS)
- [CVE-2009-1509](https://cve.now/CVE-2009-1509.md): SQL injection vulnerability in ajaxp\_backend.php in MyioSoft AjaxPortal 3.0 allows remote attackers to execute arbitrary SQL commands via th (no CVSS)
- [CVE-2009-1510](https://cve.now/CVE-2009-1510.md): Multiple directory traversal vulnerabilities in KoschtIT Image Gallery 1.82 allow remote attackers to include and execute arbitrary local fi (no CVSS)
- [CVE-2009-1511](https://cve.now/CVE-2009-1511.md): GDI+ in Microsoft Windows XP SP3 allows remote attackers to cause a denial of service (infinite loop) via a PNG file that contains a certain (no CVSS)
- [CVE-2008-6776](https://cve.now/CVE-2008-6776.md): SQL injection vulnerability in viewcomments.php in Scripts For Sites (SFS) EZ Hot or Not allows remote attackers to execute arbitrary SQL co (no CVSS)
- [CVE-2008-6777](https://cve.now/CVE-2008-6777.md): Multiple SQL injection vulnerabilities in MyPHP Forum 3.0 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) i (no CVSS)
- [CVE-2008-6778](https://cve.now/CVE-2008-6778.md): SQL injection vulnerability in viewfaqs.php in Scripts for Sites (SFS) EZ Auction allows remote attackers to execute arbitrary SQL commands (no CVSS)
- [CVE-2008-6779](https://cve.now/CVE-2008-6779.md): SQL injection vulnerability in the Sarkilar module for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the id paramet (no CVSS)
- [CVE-2008-6780](https://cve.now/CVE-2008-6780.md): SQL injection vulnerability in directory.php in Scripts for Sites (SFS) SFS EZ Affiliate allows remote attackers to execute arbitrary SQL co (no CVSS)
- [CVE-2008-6781](https://cve.now/CVE-2008-6781.md): SQL injection vulnerability in directory.php in Sites for Scripts (SFS) Gaming Directory allows remote attackers to execute arbitrary SQL co (no CVSS)
- [CVE-2008-6782](https://cve.now/CVE-2008-6782.md): SQL injection vulnerability in directory.php in Sites for Scripts (SFS) EZ Hosting Directory allows remote attackers to execute arbitrary SQ (no CVSS)
- [CVE-2008-6783](https://cve.now/CVE-2008-6783.md): SQL injection vulnerability in directory.php in Sites for Scripts (SFS) EZ Home Business Directory allows remote attackers to execute arbitr (no CVSS)
- [CVE-2008-6784](https://cve.now/CVE-2008-6784.md): SQL injection vulnerability in directory.php in Scripts For Sites (SFS) EZ Adult Directory allows remote attackers to execute arbitrary SQL (no CVSS)
- [CVE-2009-1364](https://cve.now/CVE-2009-1364.md): Use-after-free vulnerability in the embedded GD library in libwmf 0.2.8.4 allows context-dependent attackers to cause a denial of service (a (no CVSS)
- [CVE-2009-1365](https://cve.now/CVE-2009-1365.md): Unspecified vulnerability in Adobe Flash Media Server (FMS) before 3.0.4 and 3.5.x before 3.5.2, as used in Flash Media Interactive Server a (no CVSS)
- [CVE-2009-1500](https://cve.now/CVE-2009-1500.md): SQL injection vulnerability in index.php in ProjectCMS 1.0 Beta allows remote attackers to execute arbitrary SQL commands via the sn paramet (no CVSS)
- [CVE-2009-1501](https://cve.now/CVE-2009-1501.md): Cross-site scripting (XSS) vulnerability in the Exif module 5.x-1.x before 5.x-1.2 and 6.x-1.x-dev before April 13, 2009, a module for Drupa (no CVSS)
- [CVE-2009-1502](https://cve.now/CVE-2009-1502.md): Directory traversal vulnerability in plugin.php in S-Cms 1.1 Stable and 1.5.2 allows remote attackers to include and execute arbitrary local (no CVSS)
- [CVE-2009-1503](https://cve.now/CVE-2009-1503.md): Multiple SQL injection vulnerabilities in login.php in Tiger Document Management System (DMS) allow remote attackers to execute arbitrary SQ (no CVSS)
- [CVE-2009-1504](https://cve.now/CVE-2009-1504.md): Absolute Form Processor XE 1.5 allows remote attackers to bypass authentication and gain administrative access by setting the xlaAFPadmin co (no CVSS)
- [CVE-2009-1505](https://cve.now/CVE-2009-1505.md): SQL injection vulnerability in the News Page module 5.x before 5.x-1.2 for Drupal allows remote authenticated users, with News Page nodes cr (no CVSS)
- [CVE-2009-1506](https://cve.now/CVE-2009-1506.md): SQL injection vulnerability in classes/Xp.php in eLitius 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter (no CVSS)
- [CVE-2009-1507](https://cve.now/CVE-2009-1507.md): The Node Access User Reference module 5.x before 5.x-2.0-beta4 and 6.x before 6.x-2.0-beta6, a module for Drupal, interprets an empty CCK us (no CVSS)
- [CVE-2008-6775](https://cve.now/CVE-2008-6775.md): HTC Touch Pro and HTC Touch Cruise vCard allows remote attackers to cause denial of service (CPU consumption, SMS consumption, and connectiv (no CVSS)
- [CVE-2009-1495](https://cve.now/CVE-2009-1495.md): Web File Explorer 3.1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to dow (no CVSS)
- [CVE-2009-1496](https://cve.now/CVE-2009-1496.md): Directory traversal vulnerability in the Cmi Marketplace (com\_cmimarketplace) component 0.1 for Joomla! allows remote attackers to list arbi (no CVSS)
- [CVE-2009-1497](https://cve.now/CVE-2009-1497.md): Stack-based buffer overflow in srt2smi.exe in Gretech Online Movie Player (GOM Player) 2.1.16.4635 allows remote attackers to cause a denial (no CVSS)
- [CVE-2009-1498](https://cve.now/CVE-2009-1498.md): Directory traversal vulnerability in inc/profilemain.php in Game Maker 2k Internet Discussion Boards (iDB) 0.2.5 Pre-Alpha SVN 243 allows re (no CVSS)
- [CVE-2009-1499](https://cve.now/CVE-2009-1499.md): SQL injection vulnerability in the MailTo (aka com\_mailto) component in Joomla! allows remote attackers to execute arbitrary SQL commands vi (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2009-05-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.