CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 4CVE-2010-3484 – LightNEasy CMS 3.2.1 - Blind SQL Injection
https://notcve.org/view.php?id=CVE-2010-3484
SQL injection vulnerability in common.php in LightNEasy 3.2.1 allows remote attackers to execute arbitrary SQL commands via the handle parameter to LightNEasy.php, a different vector than CVE-2008-6593. Vulnerabilidad de inyección SQL en common.php en LightNEasy en v3.2.1 permite a atacantes remotos ejecutar comandos SQL de su elección a mediante la manipulación de un parámetro en LightNEasy.php, un vector diferente de CVE-2008-6593. • https://www.exploit-db.com/exploits/15060 http://packetstormsecurity.org/1009-exploits/lightneasy-sql.txt http://secunia.com/advisories/41502 http://www.exploit-db.com/exploits/15060 http://www.securityfocus.com/bid/43330 http://www.vupen.com/english/advisories/2010/2457 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2009-1937
https://notcve.org/view.php?id=CVE-2009-1937
Cross-site scripting (XSS) vulnerability in the comment posting feature in LightNEasy 2.2.1 "no database" (aka flat) and 2.2.2 SQLite allows remote attackers to inject arbitrary web script or HTML via the (1) commentname (aka Author), (2) commentemail (aka Email), and (3) commentmessage (aka Comment) parameters. NOTE: some of these details are obtained from third party information. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en funcionalidad de realizar comentarios de LightNEasy v2.2.1 "no database" (sin base de datos o "flat") and 2.2.2 SQLite. Permite a usuarios remotos inyectar codigo de script web o código HTML a través de los parámetros (1) "commentname" (autor), (2) "commentemail" (dirección de correo) y (3) "commentmessage" (comentario). NOTA: algunos de estos detalles han sido obtenidos de información proveniente de terceras partes • http://forum.intern0t.net/intern0t-advisories/1081-intern0t-lightneasy-2-2-2-html-injection-vulnerability.html http://secunia.com/advisories/35354 http://www.securityfocus.com/archive/1/504092/100/0/threaded http://www.securityfocus.com/bid/35229 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 1%CPEs: 2EXPL: 2CVE-2008-6593 – LightNEasy sqlite / no database 1.2.2 - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2008-6593
SQL injection vulnerability in LightNEasy/lightneasy.php in LightNEasy SQLite 1.2.2 and earlier allows remote attackers to inject arbitrary PHP code into comments.dat via the dlid parameter to index.php. Vulnerabilidad de inyección SQL en LightNEasy/lightneasy.php en LightNEasy SQLite v1.2.2 y anteriores permite a atacantes remotos inyectar código PHP de forma arbitraria en comments.dat a través del parámetro "dlid" en index.php. • https://www.exploit-db.com/exploits/5452 http://secunia.com/advisories/29833 http://www.osvdb.org/44675 http://www.securityfocus.com/archive/1/491064/100/0/threaded http://www.securityfocus.com/bid/28801 https://exchange.xforce.ibmcloud.com/vulnerabilities/42009 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.5EPSS: 1%CPEs: 2EXPL: 2CVE-2008-6592 – LightNEasy sqlite / no database 1.2.2 - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2008-6592
thumbsup.php in Thumbs-Up 1.12, as used in LightNEasy "no database" (aka flat) and SQLite 1.2.2 and earlier, allows remote attackers to copy, rename, and read arbitrary files via directory traversal sequences in the image parameter with a modified cache_dir parameter containing a %00 (encoded null byte). thumbsup.php en Thumbs-Up v1.12, cuando se utiliza en LightNEasy "no database" (también conocido como flat) y SQLite v1.2.2 permite a atacantes remotos copiar, renombrar, y leer ficheros de modo arbitrario a través de secuencias de salto de directorio en el parámetro "image" con un parámetro modificado cache_dir conteniendo un %00 (byte codificado nulo). • https://www.exploit-db.com/exploits/5452 http://secunia.com/advisories/29833 http://www.osvdb.org/44674 http://www.securityfocus.com/archive/1/491064/100/0/threaded http://www.securityfocus.com/bid/28801 https://exchange.xforce.ibmcloud.com/vulnerabilities/49851 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 5.0EPSS: 0%CPEs: 2EXPL: 2CVE-2008-6590 – LightNEasy sqlite / no database 1.2.2 - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2008-6590
Multiple directory traversal vulnerabilities in LightNEasy "no database" (aka flat) version 1.2.2, and possibly SQLite version 1.2.2, allow remote attackers to read arbitrary files via a .. (dot dot) in the page parameter to (1) index.php and (2) LightNEasy.php. Múltiples vulnerabilidades de salto de directorio en LightNEasy "no database" (también conocido como flat) v1.2.2, y posiblemente SQLite v1.2.2, permite a atacantes remotos leer fichero de modo arbitrario a través de ..(punto punto) en el parámetro "page" en (1) index.php y (2) LightNEasy.php. • https://www.exploit-db.com/exploits/5452 http://secunia.com/advisories/29833 http://www.osvdb.org/44672 http://www.osvdb.org/44673 http://www.securityfocus.com/archive/1/491064/100/0/threaded http://www.securityfocus.com/bid/28839 https://exchange.xforce.ibmcloud.com/vulnerabilities/41889 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •