Multiple cross-site scripting (XSS) vulnerabilities in JGS-XA JGS-Portal 3.0.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) anzahlbeitraege parameter to jgsportal.php, (2) year parameter to jgsportalstatistik.php, (3) year parameter to jgsportalbeitraggraf.php, (4) tag parameter to jgsportalviewsgraf.php, (5) year parameter to jgsportalthemengraf.php, (6) year parameter to jgsportalmitgraf.php, (7) id parameter to jgsportalsponsor.php, or (8) the Accept-Language header to jgsportallog.php. NOTE: this issue may stem from the same core problem as CVE-2005-1633.

JGS-XA JGS-Portal 3.0.2 and earlier allows remote attackers to obtain the full server path via direct requests to (1) jgsportalref.php, (2) jgsportalland.php, (3) jgsportallog.php, (4) jgsportalglobalsponsor.php, (5) jgsportalglobal.php, (6) jgsportalsystem.php, (7) jgsportalviews.php; or multiple files in the jgsportalinclude directory, including (8) jgsportalboardmenue.php, (9) jgsportalforenliste.php, (10) jgsportalgeburtstag.php, (11) jgsportalguckloch.php, (12) jgsportalkalender.php, (13) jgsportalletztethemen.php, (14) jgsportallinks.php, (15) jgsportalneustemember.php, (16) jgsportalnewsboard.php, (17) jgsportalonline.php, (18) jgsportalpn.php, (19) jgsportalportalmenue.php, (20) jgsportalstyles.php, (21) jgsportalsuchen.php, (22) jgsportalteam.php, (23) jgsportaltopforen.php, (24) jgsportaltopposter.php, (25) jgsportalumfrage.php, (26) jgsportaluseravatar.php, (27) jgsportalwaronline.php, (28) jgsportalwoonline.php, or (29) jgsportalzufallsavatar.php.

Multiple SQL injection vulnerabilities in JGS-XA JGS-Portal 3.0.2 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) anzahlbeitraege parameter to jgsportal.php, 2) year parameter to (jgsportalstatistik.php, 3) year parameter to (jgsportalbeitraggraf.php, 4) tag parameter to (jgsportalviewsgraf.php, 5) year parameter to (jgsportalthemengraf.php, 6) year parameter to (jgsportalmitgraf.php, 7) id parameter to jgsportalsponsor.php, or (8) the Accept-Language header to jgsportallog.php.

SQL injection vulnerability in jgsportal.php in JGS-Portal 3.0.1 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.

Multiple cross-site scripting (XSS) vulnerabilities in the JGS-XA JGS-Gallery Addon 4.0.0 and earlier for Woltlab Burning Board (wBB) 2.x allow remote attackers to inject arbitrary web script or HTML via the (1) userid parameter in (a) jgsgalerieslideshow.php and (b) jgsgaleriescroll.php, and the (2) katid parameter in (c) jgsgalerieslideshow.php.

SQL injection vulnerability in jgstreffen.php in the JGS-XA JGS-Treffen 2.0.2 and earlier addon for Woltlab Burning Board (wBB) allows remote attackers to execute arbitrary SQL commands via the viewid parameter in an ansicht action.