CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 2CVE-2006-2228 – W-Agora 4.2 - BBCode Script Injection
https://notcve.org/view.php?id=CVE-2006-2228
Cross-site scripting (XSS) vulnerability in w-Agora (aka Web-Agora) 4.2.0 allows remote attackers to inject arbitrary web script or HTML via a post with a BBCode tag that contains a JavaScript event name followed by whitespace before the '=' (equals) character, which bypasses a restrictive regular expression that attempts to remove onmouseover and other events. • https://www.exploit-db.com/exploits/27783 http://securityreason.com/securityalert/847 http://www.securityfocus.com/archive/1/432457/100/0/threaded http://www.securityfocus.com/bid/17751 •
CVSS: 5.0EPSS: 2%CPEs: 1EXPL: 5CVE-2005-2648 – W-Agora 4.2 - 'Site' Directory Traversal
https://notcve.org/view.php?id=CVE-2005-2648
Directory traversal vulnerability in index.php in W-Agora 4.2.0 and earlier allows remote attackers to read arbitrary files via the site parameter. • https://www.exploit-db.com/exploits/26169 http://archives.neohapsis.com/archives/fulldisclosure/2005-08/0599.html http://h4cky0u.org/viewtopic.php?t=2097 http://secunia.com/advisories/16497 http://securitytracker.com/id?1014737 http://www.securityfocus.com/archive/1/408522 http://www.securityfocus.com/bid/14597 https://exchange.xforce.ibmcloud.com/vulnerabilities/21906 •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 3CVE-2004-1562 – W-Agora 4.1.6 - 'a redir_url.php?key' SQL Injection
https://notcve.org/view.php?id=CVE-2004-1562
SQL injection vulnerability in redir_url.php in w-Agora 4.1.6a allows remote attackers to execute arbitrary SQL commands via the key parameter. • https://www.exploit-db.com/exploits/24648 http://lists.grok.org.uk/pipermail/full-disclosure/2004-September/027040.html http://marc.info/?l=bugtraq&m=109655691512298&w=2 http://secunia.com/advisories/12695 http://securitytracker.com/id?1011463 http://www.securityfocus.com/bid/11283 https://exchange.xforce.ibmcloud.com/vulnerabilities/17557 •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 5CVE-2004-1563 – W-Agora 4.1.6 - 'a download_thread.php?thread' Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2004-1563
Multiple cross-site scripting (XSS) vulnerabilities in w-Agora 4.1.6a allow remote attackers to execute arbitrary web script or HTML via the (1) thread parameter to download_thread.php, (2) loginuser parameter to login.php, or (3) userid parameter to forgot_password.php. • https://www.exploit-db.com/exploits/24650 https://www.exploit-db.com/exploits/24649 https://www.exploit-db.com/exploits/24652 http://lists.grok.org.uk/pipermail/full-disclosure/2004-September/027040.html http://marc.info/?l=bugtraq&m=109655691512298&w=2 http://secunia.com/advisories/12695 http://securitytracker.com/id?1011463 http://www.securityfocus.com/bid/11283 https://exchange.xforce.ibmcloud.com/vulnerabilities/17553 •
CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 1CVE-2004-1565
https://notcve.org/view.php?id=CVE-2004-1565
list.php in w-Agora 4.1.6a allows remote attackers to reveal the full path via a crafted HTTP request, possibly involving a malformed id parameter. • http://lists.grok.org.uk/pipermail/full-disclosure/2004-September/027040.html http://marc.info/?l=bugtraq&m=109655691512298&w=2 http://secunia.com/advisories/12695 http://securitytracker.com/id?1011463 http://www.securityfocus.com/bid/11283 •