aspapps vulnerabilities

Products

• asp autodealer 2
• aspportal 2
• template creature 2
• aspticker 1

Latest aspapps CVEs

Newest publication first

1. CVE-2008-5950 SQL injection vulnerability in media/media_level.asp in ASP Template Creature allows remote attackers to execute arbitrary SQL commands via the mcatid parameter.

   Published 2009-01-23

   High·CVSS 7.5 EPSS 0.97%

   SQL injection vulnerability in media/media_level.asp in ASP Template Creature allows remote attackers to execute arbitrary SQL commands via the mcatid parameter.

2. CVE-2008-5951 ASP Template Creature stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct request for workDB/temp...

   Published 2009-01-23

   Medium·CVSS 5.0 EPSS 2.2%

   ASP Template Creature stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct request for workDB/templatemonster.mdb.

3. CVE-2008-5603 ASPTicker 1.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct request for news.mdb.

   Published 2008-12-16

   Medium·CVSS 5.0 EPSS 2.6%

   ASPTicker 1.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct request for news.mdb.

4. CVE-2008-5605 Multiple SQL injection vulnerabilities in ASP Portal allow remote attackers to execute arbitrary SQL commands via the (1) ItemID parameter to classifieds.asp and the (2) ID parameter to Events.asp.

   Published 2008-12-16

   High·CVSS 7.5 EPSS 2.1%

   Multiple SQL injection vulnerabilities in ASP Portal allow remote attackers to execute arbitrary SQL commands via the (1) ItemID parameter to classifieds.asp and the (2) ID parameter to Events.asp.

5. CVE-2008-5595 SQL injection vulnerability in detail.asp in ASP AutoDealer allows remote attackers to execute arbitrary SQL commands via the ID parameter.

   Published 2008-12-16

   High·CVSS 7.5 EPSS 1.2%

   SQL injection vulnerability in detail.asp in ASP AutoDealer allows remote attackers to execute arbitrary SQL commands via the ID parameter.

6. CVE-2008-5608 ASP AutoDealer stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct request for auto.mdb.

   Published 2008-12-16

   Medium·CVSS 5.0 EPSS 2.9%

   ASP AutoDealer stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct request for auto.mdb.

7. CVE-2008-5562 ASPPortal stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct request for xportal.mdb.

   Published 2008-12-15

   Medium·CVSS 5.0 EPSS 5.2%

   ASPPortal stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct request for xportal.mdb.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.