CVE-2007-2685

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

Multiple SQL injection vulnerabilities in index.php in Jetbox CMS 2.1 allow remote attackers to execute arbitrary SQL commands via the (1) view or (2) login parameter.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://marc.info/?l=full-disclosure&m=117974433216496&w=2Exploit, Vendor Advisory
http://www.netvigilance.com/advisory0028Exploit, Vendor Advisory
http://www.osvdb.org/34784
http://www.securityfocus.com/archive/1/469223/100/0/threaded
http://www.securityfocus.com/bid/24077
https://exchange.xforce.ibmcloud.com/vulnerabilities/34387
http://marc.info/?l=full-disclosure&m=117974433216496&w=2Exploit, Vendor Advisory
http://www.netvigilance.com/advisory0028Exploit, Vendor Advisory
http://www.osvdb.org/34784
http://www.securityfocus.com/archive/1/469223/100/0/threaded
http://www.securityfocus.com/bid/24077
https://exchange.xforce.ibmcloud.com/vulnerabilities/34387

Timeline

Published: May 21, 2007
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2007

CVE-2007-26864.3Cross-site scripting (XSS) vulnerability in index.php in Jetbox CMS 2.1 allows remote attackers to inject arbitrary web script or HTML via t CVE-2007-268710.0Stack-based buffer overflow in the MicroWorld Agent service (MWAGENT.EXE) in MicroWorld Technologies eScan before 9.0.718.1 allows remote at CVE-2007-26887.8The Cisco Intrusion Prevention System (IPS) and IOS with Firewall/IPS Feature Set do not properly handle certain full-width and half-width U CVE-2007-26897.8Check Point Web Intelligence does not properly handle certain full-width and half-width Unicode character encodings, which might allow remot CVE-2007-26907.8Multiple IBM ISS Proventia Series products, including the A, G, and M series, do not properly handle certain full-width and half-width Unico CVE-2007-26914.9MySQL before 4.1.23, 5.0.x before 5.0.42, and 5.1.x before 5.1.18 does not require the DROP privilege for RENAME TABLE statements, which all CVE-2007-26926.0The mysql_change_db function in MySQL 5.0.x before 5.0.40 and 5.1.x before 5.1.18 does not restore THD::db_access privileges when returning CVE-2007-26933.5MySQL before 5.1.18 allows remote authenticated users without SELECT privileges to obtain sensitive information from partitioned tables via CVE-2007-26944.3Multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Express and WebLogic Server 6.1 through SP7, 7.0 through SP7, 8.1 throug CVE-2007-26955.1The HttpClusterServlet and HttpProxyServlet in BEA WebLogic Express and WebLogic Server 6.1 through SP7, 7.0 through SP7, 8.1 through SP5, 9 CVE-2007-26966.8The JMS Server in BEA WebLogic Server 6.1 through SP7, 7.0 through SP6, and 8.1 through SP5 enforces security access policies on the front e CVE-2007-26975.1The embedded LDAP server in BEA WebLogic Express and WebLogic Server 7.0 through SP6, 8.1 through SP5, 9.0, and 9.1, when in certain configu