CVSS: 9.8EPSS: 3%CPEs: 1EXPL: 1CVE-2012-6710
https://notcve.org/view.php?id=CVE-2012-6710
ext_find_user in eXtplorer through 2.1.2 allows remote attackers to bypass authentication via a password[]= (aka an empty array) in an action=login request to index.php. ext_find_user en eXtplorer hasta la versión 2.1.2 permite que atacantes remotos omitan la autenticación mediante password[]= (o array vacío) en una petición action=login en index.php. • http://itsecuritysolutions.org/2012-12-31-eXtplorer-v2.1-authentication-bypass-vulnerability http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-201212-371 https://www.securityfocus.com/bid/57058 • CWE-287: Improper Authentication •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 0CVE-2017-12756
https://notcve.org/view.php?id=CVE-2017-12756
Command inject in transfer from another server in extplorer 2.1.9 and prior allows attacker to inject command via the userfile[0] parameter. Una inyección de comandos en transferencias desde otro servidor en extplorer en se versiones 2.1.9 y anteriores permite que un atacante inyecte comandos a través del parámetro userfile[0]. • http://extplorer.net/news/21 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2015-5660
https://notcve.org/view.php?id=CVE-2015-5660
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code. Vulnerabilidad de CSRF en eXtplorer en versiones anteriores a 2.1.8 permite a atacantes remotos secuestrar la autenticación de usuarios arbitrarios en peticiones que ejecutan código PHP. • http://extplorer.net/news/18 http://jvn.jp/en/jp/JVN92520335/index.html http://jvndb.jvn.jp/jvndb/JVNDB-2015-000126 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2015-0896
https://notcve.org/view.php?id=CVE-2015-0896
Multiple cross-site scripting (XSS) vulnerabilities in eXtplorer before 2.1.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. Múltiples vulnerabilidades de XSS en eXtplorer anterior a 2.1.7 permiten a atacantes remotos inyectar secuencias de comandos web arbitrarios o HTML a través de vectores no especificados. • http://extplorer.net/news/16 http://jvn.jp/en/jp/JVN97099798/index.html http://jvndb.jvn.jp/jvndb/JVNDB-2015-000039 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 2.6EPSS: 0%CPEs: 1EXPL: 1CVE-2013-5951 – Joomla eXtplorer 2.1.3 Cross Site Scripting
https://notcve.org/view.php?id=CVE-2013-5951
Multiple cross-site scripting (XSS) vulnerabilities in eXtplorer 2.1.3, when used as a component for Joomla!, allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) application.js.php in scripts/ or (2) admin.php, (3) copy_move.php, (4) functions.php, (5) header.php, or (6) upload.php in include/. Múltiples vulnerabilidades de XSS en eXtplorer 2.1.3, cuando se utiliza como componente para Joomla!, permiten a atacantes remotos inyectar script Web o HTML arbitrarios a través del PATH_INFO hacia (1) application.js.php en scripts/ o (2) admin.php, (3) copy_move.php, (4) functions.php, (5) header.php o (6) upload.php en include/. Joomla eXtplorer component version 2.1.3 suffers from a cross site scripting vulnerability. • http://archives.neohapsis.com/archives/fulldisclosure/2014-03/0273.html http://secunia.com/advisories/57387 http://secunia.com/advisories/57482 http://www.debian.org/security/2014/dsa-2882 http://www.securityfocus.com/bid/66262 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •