CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 4CVE-2010-4861 – Webspell 4.2.1 - 'asearch.php' SQL Injection
https://notcve.org/view.php?id=CVE-2010-4861
SQL injection vulnerability in asearch.php in webSPELL 4.2.1 allows remote attackers to execute arbitrary SQL commands via the search parameter. Vulnerabilidad de inyección SQL en asearch.php de webSPELL 4.2.1. Permite a atacantes remotos ejecutar comandos SQL de su elección a través del parámetro search. • https://www.exploit-db.com/exploits/15151 http://packetstormsecurity.org/1009-exploits/webspell421-sql.txt http://securityreason.com/securityalert/8419 http://www.exploit-db.com/exploits/15151 http://www.securityfocus.com/bid/43579 http://www.webspell.org/index.php?site=files&cat=21 https://exchange.xforce.ibmcloud.com/vulnerabilities/62130 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.8EPSS: 1%CPEs: 11EXPL: 2CVE-2009-1912 – webSPELL 4.2.0e - 'page' Blind SQL Injection
https://notcve.org/view.php?id=CVE-2009-1912
Directory traversal vulnerability in src/func/language.php in webSPELL 4.2.0e and earlier allows remote attackers to include and execute arbitrary local .php files via a .. (dot dot) in a language cookie. NOTE: this can be leveraged for SQL injection by including awards.php. Vulnerabilidad de salto de directorio en src/func/language.php en webSPELL v4.2.0e y anteriores, permite a los atacantes remotos incluir y ejecutar arbitrariamente archivos locales .php a través de ..(punto punto) en una cookie de lenguaje. • https://www.exploit-db.com/exploits/8622 http://osvdb.org/54295 http://secunia.com/advisories/35016 http://www.osvdb.org/54296 http://www.securityfocus.com/bid/34862 http://www.webspell.org http://www.webspell.org/index.php?site=files&file=30 http://www.webspell.org/index.php?site=news_comments&newsID=130 https://exchange.xforce.ibmcloud.com/vulnerabilities/50395 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 2CVE-2009-1408 – webSPELL 4.2.0c - Bypass BBCode Cross-Site Scripting Cookie Stealing
https://notcve.org/view.php?id=CVE-2009-1408
Cross-site scripting (XSS) vulnerability in webSPELL 4.2.0c allows remote attackers to inject arbitrary web script or HTML allows remote attackers to inject arbitrary web script or HTML via Javascript events such as onmouseover in nested BBcode tags, as demonstrated using (1) email, (2) img, and (3) url tags. Una vunerabildad de ejecución de secuencias de comandos en sitios cruzados(XSS) en webSPELL v4.2.0c permite a atacantes remotos inyectar HTML o scripts web arbitrarios a través de eventos Javascript onmouseover en etiquetas BBcode anidadas, como se ha demostrado usando las etiquetas (1) email, (2) img, y (3) url. • https://www.exploit-db.com/exploits/8453 http://osvdb.org/53782 http://secunia.com/advisories/34764 http://www.securityfocus.com/archive/1/502732/100/0/threaded http://www.securityfocus.com/bid/34595 http://www.webspell.org/index.php?site=files&file=25 http://www.webspell.org/index.php?site=news_comments&newsID=126&lang=uk https://exchange.xforce.ibmcloud.com/vulnerabilities/49937 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 3CVE-2008-1481 – webSPELL 4.1.2 - 'index.php' Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2008-1481
Cross-site scripting (XSS) vulnerability in index.php in webSPELL 4.1.2 allows remote attackers to inject arbitrary web script or HTML via the board parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en index.php de webSPELL 4.1.2 permite a atacantes remotos inyectar secuencias de comandos web o HTML a través del parámetro board. NOTA: el origen de esta información es desconocido; los detalles se han obtenido únicamente de información de terceros. • https://www.exploit-db.com/exploits/31416 http://www.securityfocus.com/bid/28294 http://www.securityfocus.com/bid/28294/exploit https://exchange.xforce.ibmcloud.com/vulnerabilities/41417 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2008-0575
https://notcve.org/view.php?id=CVE-2008-0575
Cross-site request forgery (CSRF) vulnerability in admin/admincenter.php in webSPELL 4.01.02 allows remote attackers to assign the superadmin privilege level to arbitrary accounts as administrators via an "update member" action. Vulnerabilidad de falsificación de petición en sitios cruzados (CSRF)en admin/admincenter.php de webSPELL 4.01.02. Permite a atacantes remotos asignar el nivel de privilegios de superadmin a cuentas arbitrarias como administradores a través de una acción "update member". • http://secunia.com/advisories/28684 http://securityreason.com/securityalert/3606 http://www.securityfocus.com/archive/1/487312/100/0/threaded • CWE-352: Cross-Site Request Forgery (CSRF) •