CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 2CVE-2008-0510 – Mambo Component 'com_newsletter' 4.5 - 'listid' SQL Injection
https://notcve.org/view.php?id=CVE-2008-0510
SQL injection vulnerability in index.php in the Newsletter (com_newsletter) component for Mambo 4.5 and Joomla! allows remote attackers to execute arbitrary SQL commands via the listid parameter. Vulnerabilidad de inyección SQL en index.php en los componentes Newsletter (com_newsletter) para Mambo 4.5 y Joomla!. Permite a atacantes remotos ejecutar comandos SQL arbitrarios a través del parámetro listid. • https://www.exploit-db.com/exploits/5007 http://www.securityfocus.com/bid/27502 http://www.vupen.com/english/advisories/2008/0354 https://exchange.xforce.ibmcloud.com/vulnerabilities/40036 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.5EPSS: 0%CPEs: 20EXPL: 1CVE-2008-0517 – Mambo Component EstateAgent 0.1 - SQL Injection
https://notcve.org/view.php?id=CVE-2008-0517
SQL injection vulnerability in index.php in the Darko Selesi EstateAgent (com_estateagent) 0.1 component for Mambo 4.5.x and Joomla! allows remote attackers to execute arbitrary SQL commands via the objid parameter in a contact showObject action. Vulnerabilidad de inyección SQL en idex.php en el componente Darko Selesi EstateAgent (com_estateagent) 0.1 para Mambo 4.5.x y Joomla!. Permite a atacantes remotos ejecutar comandos SQL arbitrarios a través del parámetro objid en una acción de contacto showObject. • https://www.exploit-db.com/exploits/5016 http://www.securityfocus.com/bid/27520 http://www.vupen.com/english/advisories/2008/0362 https://exchange.xforce.ibmcloud.com/vulnerabilities/40060 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2007-0789
https://notcve.org/view.php?id=CVE-2007-0789
SQL injection vulnerability in Mambo before 4.5.5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors in cancel edit functions, possibly related to the id parameter. Una vulnerabilidad de inyección SQL en Mambo versiones anteriores a 4.5.5, permite a atacantes remotos ejecutar comandos SQL arbitrarios por medio de vectores no especificados en la cancelación de funciones edit, posiblemente relacionadas con el parámetro id. • http://mamboxchange.com/frs/shownotes.php?release_id=6232 http://osvdb.org/33088 http://secunia.com/advisories/24044 http://www.vupen.com/english/advisories/2007/0480 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.5EPSS: 1%CPEs: 21EXPL: 0CVE-2006-4286
https://notcve.org/view.php?id=CVE-2006-4286
PHP remote file inclusion vulnerability in contentpublisher.php in the contentpublisher component (com_contentpublisher) for Mambo allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter. NOTE: this issue has been disputed by third parties who state that contentpublisher.php protects against direct request in the most recent version. The original researcher is known to be frequently inaccurate ** IMPUGNADA ** Vulnerabilidad de inclusión remota de archivo en PHP en contentpublisher.php del componente contentpublisher (com_contentpublisher) para Mambo permite a atacantes remotos ejecutar código PHP de su elección mediante una URL en el parámetro mosconfig_absolute_path. NOTA: Esta vulnerabilidad ha sido impugnada por terceros que establecen que el contentpublisher.php está protegido contra peticiones directas en la versión más reciente. El investigador original es conocido por ser frecuentemente impreciso. • http://securityreason.com/securityalert/1431 http://www.osvdb.org/28093 http://www.securityfocus.com/archive/1/443626/100/0/threaded http://www.securityfocus.com/archive/1/444244/100/0/threaded •
CVSS: 7.5EPSS: 3%CPEs: 1EXPL: 3CVE-2006-3262 – Mambo 4.6rc1 - Weblinks Blind SQL Injection
https://notcve.org/view.php?id=CVE-2006-3262
SQL injection vulnerability in the Weblinks module (weblinks.php) in Mambo 4.6rc1 and earlier allows remote attackers to execute arbitrary SQL commands via the title parameter. Vulnerabilidad de inyección SQL en el modulo Weblinks (weblinks.php) en Mambo v4.6rc1 y anteriores permite a atacantes remotos ejecutar comandos SQL arbitrarios a través del parámetro "title". • https://www.exploit-db.com/exploits/1920 https://www.exploit-db.com/exploits/1941 http://retrogod.altervista.org/mambo_46rc1_sql.html http://secunia.com/advisories/20745 http://securityreason.com/securityalert/1158 http://securitytracker.com/id?1016334 http://www.mamboserver.com/?option=com_content&task=view&id=207 http://www.osvdb.org/26624 http://www.securityfocus.com/archive/1/437496/100/100/threaded http://www.securityfocus.com/bid/18492 http://www.vupen.com/englis •