CVSS: 6.8EPSS: 1%CPEs: 11EXPL: 2CVE-2009-1912 – webSPELL 4.2.0e - 'page' Blind SQL Injection
https://notcve.org/view.php?id=CVE-2009-1912
Directory traversal vulnerability in src/func/language.php in webSPELL 4.2.0e and earlier allows remote attackers to include and execute arbitrary local .php files via a .. (dot dot) in a language cookie. NOTE: this can be leveraged for SQL injection by including awards.php. Vulnerabilidad de salto de directorio en src/func/language.php en webSPELL v4.2.0e y anteriores, permite a los atacantes remotos incluir y ejecutar arbitrariamente archivos locales .php a través de ..(punto punto) en una cookie de lenguaje. • https://www.exploit-db.com/exploits/8622 http://osvdb.org/54295 http://secunia.com/advisories/35016 http://www.osvdb.org/54296 http://www.securityfocus.com/bid/34862 http://www.webspell.org http://www.webspell.org/index.php?site=files&file=30 http://www.webspell.org/index.php?site=news_comments&newsID=130 https://exchange.xforce.ibmcloud.com/vulnerabilities/50395 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 3CVE-2008-1481 – webSPELL 4.1.2 - 'index.php' Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2008-1481
Cross-site scripting (XSS) vulnerability in index.php in webSPELL 4.1.2 allows remote attackers to inject arbitrary web script or HTML via the board parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en index.php de webSPELL 4.1.2 permite a atacantes remotos inyectar secuencias de comandos web o HTML a través del parámetro board. NOTA: el origen de esta información es desconocido; los detalles se han obtenido únicamente de información de terceros. • https://www.exploit-db.com/exploits/31416 http://www.securityfocus.com/bid/28294 http://www.securityfocus.com/bid/28294/exploit https://exchange.xforce.ibmcloud.com/vulnerabilities/41417 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2008-0575
https://notcve.org/view.php?id=CVE-2008-0575
Cross-site request forgery (CSRF) vulnerability in admin/admincenter.php in webSPELL 4.01.02 allows remote attackers to assign the superadmin privilege level to arbitrary accounts as administrators via an "update member" action. Vulnerabilidad de falsificación de petición en sitios cruzados (CSRF)en admin/admincenter.php de webSPELL 4.01.02. Permite a atacantes remotos asignar el nivel de privilegios de superadmin a cuentas arbitrarias como administradores a través de una acción "update member". • http://secunia.com/advisories/28684 http://securityreason.com/securityalert/3606 http://www.securityfocus.com/archive/1/487312/100/0/threaded • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 2CVE-2008-0574 – webSPELL 4.1.2 - 'whoisonline.php' Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2008-0574
Cross-site scripting (XSS) vulnerability in index.php in webSPELL 4.01.02 allows remote attackers to inject arbitrary web script or HTML via the sort parameter in a whoisonline action. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en index.php de webSPELL 4.01.02 permite a atacantes remotos inyectar web script o HTML de su elección a través del parámetro sort en una acción whoisonline. • https://www.exploit-db.com/exploits/31079 http://secunia.com/advisories/28684 http://securityreason.com/securityalert/3606 http://www.securityfocus.com/archive/1/487312/100/0/threaded http://www.securityfocus.com/bid/27517 https://exchange.xforce.ibmcloud.com/vulnerabilities/40084 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 3CVE-2007-6309 – webSPELL 4.1.2 - 'calendar.php' Multiple Cross-Site Scripting Vulnerabilities
https://notcve.org/view.php?id=CVE-2007-6309
Multiple cross-site scripting (XSS) vulnerabilities in index.php in webSPELL 4.1.2 allow remote attackers to inject arbitrary web script or HTML via (1) the galleryID parameter in a usergallery upload action; or the (2) upID, (3) tag, (4) month, (5) userID, or (6) year parameter in a calendar announce action. Múltiples vulnerabilidades de secuencia de comandos en sitios cruzados (XSS) en index.php en webSPELL 4.1.2 permite a atacantes remotos inyectar secuencias de comandos web o HTML a través del parámetro (1) galleryID en una acción de actualización usergallery; o los parámetros (2) upID, (3) tag, (4) month, (5) userID, o (6) year en una acción de anuncio en el calendario. • https://www.exploit-db.com/exploits/30858 https://www.exploit-db.com/exploits/30857 http://secunia.com/advisories/28006 http://securityreason.com/securityalert/3429 http://www.securityfocus.com/archive/1/484795/100/0/threaded http://www.securityfocus.com/bid/26787 https://exchange.xforce.ibmcloud.com/vulnerabilities/38955 https://exchange.xforce.ibmcloud.com/vulnerabilities/38957 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •