CVSS: 6.8EPSS: 8%CPEs: 4EXPL: 2CVE-2007-6347 – ViArt CMS/Shop/Helpdesk 3.3.2 - Remote File Inclusion
https://notcve.org/view.php?id=CVE-2007-6347
PHP remote file inclusion vulnerability in blocks/block_site_map.php in ViArt (1) CMS 3.3.2, (2) HelpDesk 3.3.2, (3) Shop Evaluation 3.3.2, and (4) Shop Free 3.3.2 allows remote attackers to execute arbitrary PHP code via a URL in the root_folder_path parameter. NOTE: some of these details are obtained from third party information. Vulnerabilidad de inclusión remota de archivo en PHP en blocks/block_site_map.php de ViArt (1) CMS 3.3.2, (2) HelpDesk 3.3.2, (3) Shop Evaluation 3.3.2, y (4) Shop Free 3.3.2 permite a atacantes remotos ejecutar código PHP de su elección mediante un URL en el parámetro root_folder_path. NOTA: algunos de estos detalles se han obtenido de información de terceros. • https://www.exploit-db.com/exploits/4722 http://osvdb.org/42628 http://secunia.com/advisories/28066 http://www.securityfocus.com/bid/26828 http://www.vupen.com/english/advisories/2007/4207 https://exchange.xforce.ibmcloud.com/vulnerabilities/38993 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2006-2980
https://notcve.org/view.php?id=CVE-2006-2980
SQL injection vulnerability in block_forum_topic_new.php in ViArt Shop Free 2.5.5, and possibly other distributions including Light, Standard, and Enterprise, might allow remote attackers to execute arbitrary SQL commands via unknown vectors, probably involving the forum_id parameter. • http://www.attrition.org/pipermail/vim/2006-June/000846.html http://www.codetosell.com/downloads/xss_fix.zip https://exchange.xforce.ibmcloud.com/vulnerabilities/27684 •