CVSS: 6.4EPSS: 1%CPEs: 2EXPL: 0CVE-2006-2688
https://notcve.org/view.php?id=CVE-2006-2688
SQL injection vulnerability in the employees node (class.employee.inc) in Achievo 1.1.0 and earlier and 1.2 and earlier allows remote attackers to execute arbitrary SQL commands via the atkselector parameter. • http://bugzilla.achievo.org/show_bug.cgi?id=624 http://secunia.com/advisories/20327 http://www.achievo.org/download/releasenotes/1_2_1 http://www.osvdb.org/25811 http://www.securityfocus.com/bid/18171 http://www.vupen.com/english/advisories/2006/2053 https://exchange.xforce.ibmcloud.com/vulnerabilities/26755 •
CVSS: 7.5EPSS: 7%CPEs: 10EXPL: 3CVE-2002-1435 – Achievo 0.7/0.8/0.9 - Remote File Inclusion / Command Execution
https://notcve.org/view.php?id=CVE-2002-1435
class.atkdateattribute.js.php in Achievo 0.7.0 through 0.9.1, except 0.8.2, allows remote attackers to execute arbitrary PHP code when the 'allow_url_fopen' setting is enabled via a URL in the config_atkroot parameter that points to the code. class.atkdateattribute.js.php en Achievo 0.7.0 hasta 0.9.1 excepto 0.8.2, permite que atacantes remotos ejecuten código PHP arbitrario cuando la opción "allow_url_fopen" está establecida mediante URL en el parámetro config_atkroot que apunta al código. • https://www.exploit-db.com/exploits/21745 http://archives.neohapsis.com/archives/bugtraq/2002-08/0235.html http://www.achievo.org/lists/2002/Aug/msg00092.html http://www.iss.net/security_center/static/9947.php http://www.securityfocus.com/bid/5552 •