E Friends

e-friends

Vendor: Alstrasoft • 6 CVEs

CVEs (6)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2007-6106 1Alstrasoft 1E Friends Apr 23, 2026 Nov 23, 2007 N/A· v4 N/A· v3 7.5 HIGH· v2 SQL injection vulnerability in index.php in AlstraSoft E-Friends 4.98 and earlier allows remote attackers to execute arbitrary SQL commands via the seid parameter in a viewevent action.
CVE-2007-4080 1Alstrasoft 1E Friends Apr 23, 2026 Jul 30, 2007 N/A· v4 N/A· v3 6.4 MEDIUM· v2 Cross-site scripting (XSS) vulnerability in index.php AlstraSoft E-Friends allows remote attackers to inject arbitrary web script or HTML via the p_id parameter in a people_card action. NOTE: this might overlap CVE-2006...Show more Cross-site scripting (XSS) vulnerability in index.php AlstraSoft E-Friends allows remote attackers to inject arbitrary web script or HTML via the p_id parameter in a people_card action. NOTE: this might overlap CVE-2006-2564.Show less
CVE-2007-2824 1Alstrasoft 1E Friends Apr 23, 2026 May 22, 2007 N/A· v4 N/A· v3 10.0 HIGH· v2 SQL injection vulnerability in paypal.php in AlstraSoft E-Friends 4.21 and earlier allows remote attackers to execute arbitrary SQL commands via the pack parameter in a paypal action for index.php.
CVE-2006-4913 1Alstrasoft 1E Friends Apr 16, 2026 Sep 21, 2006 N/A· v4 N/A· v3 7.5 HIGH· v2 Directory traversal vulnerability in chat/getStartOptions.php in AlstraSoft E-friends 4.85 allows remote attackers to include arbitrary local files and possibly execute arbitrary code via a .. (dot dot) sequence and trai...Show more Directory traversal vulnerability in chat/getStartOptions.php in AlstraSoft E-friends 4.85 allows remote attackers to include arbitrary local files and possibly execute arbitrary code via a .. (dot dot) sequence and trailing null (%00) byte in the lang parameter, as demonstrated by injecting PHP code into a log file.Show less
CVE-2006-2564 1Alstrasoft 1E Friends Apr 16, 2026 May 24, 2006 N/A· v4 N/A· v3 4.3 MEDIUM· v2 Multiple cross-site scripting (XSS) vulnerabilities in index.php in AlstraSoft E-Friends allow remote attackers to inject arbitrary web script or HTML by (1) posting a blog, (2) posting a listing, (3) posting an event, (...Show more Multiple cross-site scripting (XSS) vulnerabilities in index.php in AlstraSoft E-Friends allow remote attackers to inject arbitrary web script or HTML by (1) posting a blog, (2) posting a listing, (3) posting an event, (4) adding comments, or (5) sending a message.Show less
CVE-2005-3062 1Alstrasoft 1E Friends Apr 16, 2026 Sep 27, 2005 N/A· v4 N/A· v3 7.5 HIGH· v2 PHP remote file inclusion vulnerability in index.php in AlstraSoft E-Friends 4.0 allows remote attackers to execute arbitrary PHP code via the mode parameter.