Unrestricted file upload vulnerability in imageupload.php in the SimpleBoard (comsimpleboard) component 1.0.1 and earlier for Mambo allows remote attackers to execute arbitrary code by uploading a file with an executable extension and an image/jpeg content type, then accessing this file via a direct request to the file in components/comsimpleboard/, a different vulnerability than CVE-2006-3528.

SQL injection vulnerability in webhosting.php in the Webhosting Component (comwebhosting) module before 1.1 RC7 for Joomla! and Mambo allows remote attackers to execute arbitrary SQL commands via the catid parameter to index.php.

SQL injection vulnerability in the MambAds (commambads) component 1.0 RC1 Beta and 1.0 RC1 for Mambo allows remote attackers to execute arbitrary SQL commands via the macat parameter in a view action to index.php, a different vector than CVE-2007-5177.

SQL injection vulnerability in subvotepic.php in the Datsogallery (comdatsogallery) module 1.6 for Joomla! allows remote attackers to execute arbitrary SQL commands via the User-Agent HTTP header.

SQL injection vulnerability in the Xe webtv (comxewebtv) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a detail action to index.php.

SQL injection vulnerability in the Showroom Joomlearn LMS (comlms) component for Joomla! and Mambo allows remote attackers to execute arbitrary SQL commands via the cat parameter in a showTests task.

Multiple cross-site scripting (XSS) vulnerabilities in Mambo 4.6.2 and 4.6.5, when registerglobals is enabled, allow remote attackers to inject arbitrary web script or HTML via the (1) query string to mambots/editors/mostlyce/jscripts/tinymce/filemanager/connectors/php/connector.php and the (2) mosConfigsitename parameter to administrator/popups/index3pop.php.

PHP remote file inclusion vulnerability in includes/Cache/Lite/Output.php in the CacheLite package in Mambo 4.6.4 and earlier, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the mosConfigabsolutepath parameter.

Directory traversal vulnerability in index.php in the joomlaXplorer (comjoomlaxplorer) Mambo/Joomla! component 1.6.2 and earlier allows remote attackers to list arbitrary directories via a .. (dot dot) in the dir parameter in a showerror action.

SQL injection vulnerability in index.php in the MGFi XfaQ (comxfaq) 1.2 component for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the aid parameter in an answer action.

SQL injection vulnerability in jooget.php in the Joomlapixel Jooget! (comjooget) 2.6.8 component for Joomla! and Mambo allows remote attackers to execute arbitrary SQL commands via the id parameter in a detail task.

SQL injection vulnerability in index.php in the Newsletter (comnewsletter) component for Mambo 4.5 and Joomla! allows remote attackers to execute arbitrary SQL commands via the listid parameter.

SQL injection vulnerability in index.php in the Arthur Konze AkoGallery (comakogallery) 2.5 beta component for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a detail action.

SQL injection vulnerability in index.php in the Restaurant (comrestaurant) 1.0 component for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a detail action.

SQL injection vulnerability in index.php in the Darko Selesi EstateAgent (comestateagent) 0.1 component for Mambo 4.5.x and Joomla! allows remote attackers to execute arbitrary SQL commands via the objid parameter in a contact showObject action.