CVSS: 5.0EPSS: 0%CPEs: 2EXPL: 1CVE-2008-6591
https://notcve.org/view.php?id=CVE-2008-6591
LightNEasy "no database" (aka flat) version 1.2.2, and possibly SQLite version 1.2.2, allows remote attackers to create arbitrary files via the page parameter to (1) index.php and (2) LightNEasy.php. LightNEasy "no database" (también conocido flat) v1.2.2, y posiblemente SQLite v1.2.2, permite a atacantes remotos crear ficheros a su elección a través del parámetro "page" a (1) index.php y (2) LightNEasy.php. • http://osvdb.org/44678 http://osvdb.org/44679 http://secunia.com/advisories/29833 http://www.securityfocus.com/archive/1/491064/100/0/threaded http://www.securityfocus.com/bid/28839 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 2CVE-2008-6589
https://notcve.org/view.php?id=CVE-2008-6589
Multiple cross-site scripting (XSS) vulnerabilities in LightNEasy "no database" (aka flat) version 1.2.2, and possibly SQLite version 1.2.2, allow remote attackers to inject arbitrary web script or HTML via the page parameter to (1) index.php and (2) LightNEasy.php. Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en LightNEasy "no database" (también conocido como flat) v1.2.2, y posiblemente SQLite v1.2.2, permite a atacantes remotos inyectar secuencias de comandos web o HTML de modo arbitrario a través del parámetro "page" en (1) index.php y (2) LightNEasy.php. • http://secunia.com/advisories/29833 http://www.osvdb.org/44676 http://www.osvdb.org/44677 http://www.securityfocus.com/archive/1/491064/100/0/threaded http://www.securityfocus.com/bid/28839 https://exchange.xforce.ibmcloud.com/vulnerabilities/41888 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.0EPSS: 2%CPEs: 1EXPL: 1CVE-2008-6537 – LightNEasy 1.2 - no database Remote Hash Retrieve
https://notcve.org/view.php?id=CVE-2008-6537
LightNEasy/lightneasy.php in LightNEasy No database version 1.2 allows remote attackers to obtain the hash of the administrator password via the setup "do" action to LightNEasy.php, which is cleared from $_GET but later accessed using $_REQUEST. LightNEasy/lightneasy.php en LightNEasy No database v1.2 permite a atacantes remotos conseguir el hash del password del administrador a través de la acción de configuración "do" a LightNEasy.php, que es eliminada desde $_GET pero posteriormente accedida usando $_REQUEST. • https://www.exploit-db.com/exploits/5425 http://osvdb.org/44397 http://secunia.com/advisories/29757 https://exchange.xforce.ibmcloud.com/vulnerabilities/41768 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •