CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 3CVE-2008-2029 – MiniBB 2.2 - Cross-Site Scripting / SQL Injection / Full Path Disclosure
https://notcve.org/view.php?id=CVE-2008-2029
Multiple SQL injection vulnerabilities in (1) setup_mysql.php and (2) setup_options.php in miniBB 2.2 and possibly earlier, when register_globals is enabled, allow remote attackers to execute arbitrary SQL commands via the xtr parameter in a userinfo action to index.php. Múltiples vulnerabilidades de inyección SQL en 1) setup_mysql.php y (2) setup_options.php de miniBB 2.2 y posiblemente anteriores, cuando está habilitado register_globals, permite a atacantes remotos ejecutar comandos SQL de su elección mediante el parámetro xtr en una acción userinfo a index.php. • https://www.exploit-db.com/exploits/5494 http://secunia.com/advisories/29997 http://www.minibb.net/forums/9_5110_0.html http://www.securityfocus.com/bid/28930 https://exchange.xforce.ibmcloud.com/vulnerabilities/42014 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 2CVE-2008-2024 – MiniBB 2.2 - Cross-Site Scripting / SQL Injection / Full Path Disclosure
https://notcve.org/view.php?id=CVE-2008-2024
Cross-site scripting (XSS) vulnerability in index.php in miniBB 2.2, and possibly earlier, when register_globals is enabled, allows remote attackers to inject arbitrary web script or HTML via the glang[] parameter in a registernew action. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en index.php de miniBB 2.2 y posiblemente anteriores, cuando está habilitado register_globals, permite a atacantes remotos inyectar secuencias de comandos o HTML de su elección mediante el parámetro glang[] en una acción registernew. • https://www.exploit-db.com/exploits/5494 http://secunia.com/advisories/29997 http://www.minibb.net/forums/9_5110_0.html http://www.securityfocus.com/bid/28930 https://exchange.xforce.ibmcloud.com/vulnerabilities/42013 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •