CVSS: 6.4EPSS: 0%CPEs: 2EXPL: 1CVE-2006-0871 – Mambo < 4.5.3h - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2006-0871
Directory traversal vulnerability in the _setTemplate function in Mambo 4.5.3, 4.5.3h, and possibly earlier versions allows remote attackers to read and include arbitrary files via the mos_change_template parameter. NOTE: CVE-2006-1794 has been assigned to the SQL injection vector. • https://www.exploit-db.com/exploits/43835 http://archives.neohapsis.com/archives/bugtraq/2006-02/0463.html http://secunia.com/advisories/18935 http://securityreason.com/securityalert/493 http://source.mambo-foundation.org/view/news/Announcements/Security_Patch_Released http://www.gulftech.org/?node=research&article_id=00104-02242006 http://www.osvdb.org/23505 http://www.vupen.com/english/advisories/2006/0719 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.5EPSS: 1%CPEs: 6EXPL: 1CVE-2005-2002 – Mambo 4.5.2.1 - Fetch Password Hash
https://notcve.org/view.php?id=CVE-2005-2002
SQL injection vulnerability in content.php in Mambo 4.5.2.2 and earlier allows remote attackers to execute arbitrary SQL commands via the user_rating parameter. • https://www.exploit-db.com/exploits/1049 http://mamboforge.net/frs/download.php/6153/CHANGELOG http://marc.info/?l=bugtraq&m=111885974124936&w=2 http://secunia.com/advisories/15710 http://securitytracker.com/id?1014222 http://www.osvdb.org/17323 http://www.securityfocus.com/bid/13966 •