Page 3 of 12 results (0.004 seconds)

CVSS: 9.8EPSS: 3%CPEs: 1EXPL: 1

Variable extraction vulnerability in include/common.php in exV2 2.0.4.3 and earlier allows remote attackers to overwrite arbitrary program variables and conduct directory traversal attacks to execute arbitrary code by modifying the $xoopsOption['pagetype'] variable. Vulnerabilidad de extracción de variable en include/common.php de exV2 2.0.4.3 y anteriores permite a atacantes remotos sobrescribir variables de programa de su elección y llevar a cabo ataques de salto de directorio para ejecutar código de su elección modificando la variable $xoopsOption['pagetype']. • https://www.exploit-db.com/exploits/2415 http://www.securityfocus.com/bid/20161 https://exchange.xforce.ibmcloud.com/vulnerabilities/29116 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-913: Improper Control of Dynamically-Managed Code Resources •

CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 2

SQL injection vulnerability in modules/messages/index.php in exV2 2.0.4.3 and earlier allows remote authenticated users to execute arbitrary SQL commands via the sort parameter. Vulnerabilidad de inyección SQL en modules/messages/index.php en exV2 2.0.4.3 y anteriores permite a un usuario remoto validado ejecutar comandos SQL de su elección a través del parámetro sort. • https://www.exploit-db.com/exploits/2406 http://secunia.com/advisories/22045 http://www.securityfocus.com/bid/20143 https://exchange.xforce.ibmcloud.com/vulnerabilities/29079 •