CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2007-4365
https://notcve.org/view.php?id=CVE-2007-4365
Cross-site scripting (XSS) vulnerability in eXV2 CMS 2.0.5 and earlier allows remote attackers to inject arbitrary web script or HTML via a set_lang cookie to an unspecified component. NOTE: this may overlap CVE-2007-1965. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en eXV2 CMS 2.0.5 y anteriores permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elección mediante una cookie set_lang para un componente no especificado. NOTA: esto podría solaparse con CVE-2007-1965. • http://osvdb.org/36479 http://securityreason.com/securityalert/3021 http://www.i-s-o.org/security.txt http://www.securityfocus.com/archive/1/476287/100/0/threaded https://exchange.xforce.ibmcloud.com/vulnerabilities/35992 •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2007-1965
https://notcve.org/view.php?id=CVE-2007-1965
Multiple cross-site scripting (XSS) vulnerabilities in eXV2 CMS 2.0.4.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the set_lang parameter to (1) archive.php, (2) article.php, (3) index.php, or (4) topics.php. Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en eXV2 CMS 2.0.4.3 y anteriores permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elección a (1) archive.php, (2) article.php, (3) index.php, o (4) topics.php. • http://marc.info/?l=bugtraq&m=117570977117962&w=2 http://www.majorsecurity.de/index_2.php?major_rls=major_rls38 http://www.securityfocus.com/bid/23314 •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 2CVE-2006-7080 – exV2 < 2.0.4.3 - 'extract()' Remote Command Execution
https://notcve.org/view.php?id=CVE-2006-7080
Directory traversal vulnerability in the avatar upload feature in exV2 2.0.4.3 and earlier allows remote attackers to delete arbitrary files via ".." sequences in the old_avatar parameter. Vulnerabilidad de escalado de directorio en la funcionalidad promocionar avatar en exV2 2.0.4.3 y versiones anteriores permite a atacantes remotos borrar ficheros de su elección mediante secuencias ".." en el parámetro old_avatar. • https://www.exploit-db.com/exploits/2415 http://www.securityfocus.com/bid/20161 https://exchange.xforce.ibmcloud.com/vulnerabilities/29130 •
CVSS: 9.8EPSS: 3%CPEs: 1EXPL: 1CVE-2006-7079 – exV2 < 2.0.4.3 - 'extract()' Remote Command Execution
https://notcve.org/view.php?id=CVE-2006-7079
Variable extraction vulnerability in include/common.php in exV2 2.0.4.3 and earlier allows remote attackers to overwrite arbitrary program variables and conduct directory traversal attacks to execute arbitrary code by modifying the $xoopsOption['pagetype'] variable. Vulnerabilidad de extracción de variable en include/common.php de exV2 2.0.4.3 y anteriores permite a atacantes remotos sobrescribir variables de programa de su elección y llevar a cabo ataques de salto de directorio para ejecutar código de su elección modificando la variable $xoopsOption['pagetype']. • https://www.exploit-db.com/exploits/2415 http://www.securityfocus.com/bid/20161 https://exchange.xforce.ibmcloud.com/vulnerabilities/29116 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-913: Improper Control of Dynamically-Managed Code Resources •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 2CVE-2006-5030 – exV2 < 2.0.4.3 - 'sort' SQL Injection
https://notcve.org/view.php?id=CVE-2006-5030
SQL injection vulnerability in modules/messages/index.php in exV2 2.0.4.3 and earlier allows remote authenticated users to execute arbitrary SQL commands via the sort parameter. Vulnerabilidad de inyección SQL en modules/messages/index.php en exV2 2.0.4.3 y anteriores permite a un usuario remoto validado ejecutar comandos SQL de su elección a través del parámetro sort. • https://www.exploit-db.com/exploits/2406 http://secunia.com/advisories/22045 http://www.securityfocus.com/bid/20143 https://exchange.xforce.ibmcloud.com/vulnerabilities/29079 •