CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2007-6541
https://notcve.org/view.php?id=CVE-2007-6541
Multiple cross-site scripting (XSS) vulnerabilities in neuron news 1.0 allow remote attackers to inject arbitrary web script or HTML via (1) the topic parameter in a viewtopic action, or the (2) newsyear or (3) newsmonth parameter in a newsarchive action to the default URI in patch/. Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en neuron news 1.0 permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elección a través del parámetro (1) topic en una acción viewtopic o los parámetros (2) newsyear o (3) newsmonth en una acción mewsarchive para el URI por defecto en patch/. • http://securityreason.com/securityalert/3489 http://www.securityfocus.com/archive/1/485176/100/0/threaded • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 3%CPEs: 1EXPL: 1CVE-2007-5050 – neuron news 1.0 - 'index.php?q' Local File Inclusion
https://notcve.org/view.php?id=CVE-2007-5050
Directory traversal vulnerability in index.php in Neuron News 1.0 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the q parameter. Vulnerabilidad de salto de directorio en index.php de Neuron News 1.0 permite a atacantes remotos incluir y ejecutar archivos locales de su elección mediante un .. (punto punto) en el parámetro q. • https://www.exploit-db.com/exploits/4439 http://osvdb.org/38728 http://www.securityfocus.com/archive/1/480233/100/0/threaded http://www.securityfocus.com/bid/25759 http://www.vupen.com/english/advisories/2007/3248 https://exchange.xforce.ibmcloud.com/vulnerabilities/36717 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 1CVE-2006-3386
https://notcve.org/view.php?id=CVE-2006-3386
index.php in Vincent Leclercq News 5.2 allows remote attackers to obtain sensitive information, such as the installation path, via a mail[] parameter with invalid values. index.php en Vincent Leclercq News 5.2 permite a los atacantes remotos obtener información sensible, como la ruta de instalación, a través del parámetro mail[] con valores no válidos. • http://secunia.com/advisories/20936 http://www.acid-root.new.fr/advisories/news52.txt http://www.securityfocus.com/archive/1/438859/100/0/threaded https://exchange.xforce.ibmcloud.com/vulnerabilities/27506 •