CVSS: 4.3EPSS: 0%CPEs: 30EXPL: 0CVE-2006-0664
https://notcve.org/view.php?id=CVE-2006-0664
Cross-site scripting (XSS) vulnerability in config_defaults_inc.php in Mantis before 1.0 allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. An original vendor bug report is referenced, but not accessible to the general public. • http://secunia.com/advisories/21400 http://www.debian.org/security/2006/dsa-1133 http://www.securityfocus.com/bid/16561 http://www.vupen.com/english/advisories/2006/0485 https://exchange.xforce.ibmcloud.com/vulnerabilities/24585 •
CVSS: 10.0EPSS: 0%CPEs: 30EXPL: 0CVE-2006-0665
https://notcve.org/view.php?id=CVE-2006-0665
Unspecified vulnerability in (1) query_store.php and (2) manage_proj_create.php in Mantis before 1.0.0 has unknown impact and attack vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. An original vendor bug report is referenced, but not accessible to the general public. • http://secunia.com/advisories/21400 http://www.debian.org/security/2006/dsa-1133 http://www.securityfocus.com/bid/16561 http://www.vupen.com/english/advisories/2006/0485 •
CVSS: 7.5EPSS: 2%CPEs: 7EXPL: 5CVE-2006-0147 – Simplog 0.9.2 - 's' Remote Command Execution
https://notcve.org/view.php?id=CVE-2006-0147
Dynamic code evaluation vulnerability in tests/tmssql.php test script in ADOdb for PHP before 4.70, as used in multiple products including (1) Mantis, (2) PostNuke, (3) Moodle, (4) Cacti, (5) Xaraya, (6) PhpOpenChat, possibly (7) MAXdev MD-Pro, and (8) Simplog, allows remote attackers to execute arbitrary PHP functions via the do parameter, which is saved in a variable that is then executed as a function, as demonstrated using phpinfo. • https://www.exploit-db.com/exploits/1663 http://retrogod.altervista.org/phpopenchat_30x_sql_xpl.html http://retrogod.altervista.org/simplog_092_incl_xpl.html http://secunia.com/advisories/17418 http://secunia.com/advisories/18233 http://secunia.com/advisories/18254 http://secunia.com/advisories/18260 http://secunia.com/advisories/18267 http://secunia.com/advisories/18276 http://secunia.com/advisories/19555 http://secunia.com/advisories/19590 http://secunia.com/advisories/19591& •
CVSS: 7.5EPSS: 7%CPEs: 8EXPL: 6CVE-2006-0146 – Simplog 0.9.2 - 's' Remote Command Execution
https://notcve.org/view.php?id=CVE-2006-0146
The server.php test script in ADOdb for PHP before 4.70, as used in multiple products including (1) Mantis, (2) PostNuke, (3) Moodle, (4) Cacti, (5) Xaraya, (6) PHPOpenChat, (7) MAXdev MD-Pro, and (8) MediaBeez, when the MySQL root password is empty, allows remote attackers to execute arbitrary SQL commands via the sql parameter. • https://www.exploit-db.com/exploits/1663 http://retrogod.altervista.org/phpopenchat_30x_sql_xpl.html http://secunia.com/advisories/17418 http://secunia.com/advisories/18233 http://secunia.com/advisories/18254 http://secunia.com/advisories/18260 http://secunia.com/advisories/18267 http://secunia.com/advisories/18276 http://secunia.com/advisories/18720 http://secunia.com/advisories/19555 http://secunia.com/advisories/19563 http://secunia.com/advisories/19590 http://secunia. • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.5EPSS: 1%CPEs: 50EXPL: 1CVE-2005-4518
https://notcve.org/view.php?id=CVE-2005-4518
Mantis before 0.19.4 allows remote attackers to bypass the file upload size restriction by modifying the max_file_size parameter to (1) bug_file_add.php, (2) bug_report.php, (3) bug_report_advanced_page.php, and (4) proj_doc_add_page.php. • http://secunia.com/advisories/18181 http://secunia.com/advisories/18221 http://secunia.com/advisories/18481 http://sourceforge.net/project/shownotes.php?release_id=377932&group_id=14963 http://www.debian.org/security/2005/dsa-944 http://www.gentoo.org/security/en/glsa/glsa-200512-12.xml http://www.osvdb.org/22056 http://www.securityfocus.com/bid/16046 http://www.trapkit.de/advisories/TKADV2005-11-002.txt http://www.vupen.com/english/advisories/2005/3064 •