CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 3CVE-2008-7089 – Pligg CMS 9.9.0 - Cross-Site Scripting / Local File Inclusion / SQL Injection
https://notcve.org/view.php?id=CVE-2008-7089
Cross-site scripting (XSS) vulnerability in Pligg 9.9 and earlier allows remote attackers to inject arbitrary web script or HTML via the keyword parameter in a search action to user.php and other unspecified vectors. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados en Pligg v9.9 y anteriores, permite a atacantes remotos inyectar secuencias de comandos web y HTML de su elección a través del parámetro "keyword" en una acción search a user.php y otros vectores no especificados. • https://www.exploit-db.com/exploits/6173 http://www.gulftech.org/?node=research&article_id=00120-07312008 http://www.osvdb.org/50186 http://www.securityfocus.com/archive/1/494987/100/0/threaded http://www.securityfocus.com/bid/30458 https://exchange.xforce.ibmcloud.com/vulnerabilities/44187 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 4CVE-2008-7091 – Pligg CMS 9.9.0 - Remote Code Execution
https://notcve.org/view.php?id=CVE-2008-7091
Multiple SQL injection vulnerabilities in Pligg 9.9 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to vote.php, which is not properly handled in libs/link.php; (2) id parameter to trackback.php; (3) an unspecified parameter to submit.php; (4) requestTitle variable in a query to story.php; (5) requestID and (6) requestTitle variables in recommend.php; (7) categoryID parameter to cloud.php; (8) title parameter to out.php; (9) username parameter to login.php; (10) id parameter to cvote.php; and (11) commentid parameter to edit.php. Múltiples vulnerabilidades de inyección SQL en Pligg v9.9 y anteriores, permite a atacantes remotos ejecutar comandos SQL de su elección a través de el (1)parámetro id a vote.php, que no está manejado adecuadamente en libs/link.php; de los parámetros (2) id ao trackback.php; (3) un parámetro no especificado a submit.php; (4) la variable requestTitle en una consulta a story.php; las variables (5) requestID y (6) requestTitle en recommend.php; los parámetros(7) categoryID a cloud.php; (8) title a out.php; (9) username a login.php; (10) id a cvote.php y(11) commentid a edit.php. • https://www.exploit-db.com/exploits/6172 https://www.exploit-db.com/exploits/6173 http://www.gulftech.org/?node=research&article_id=00120-07312008 http://www.osvdb.org/50189 http://www.osvdb.org/50190 http://www.osvdb.org/50191 http://www.osvdb.org/50192 http://www.osvdb.org/50193 http://www.osvdb.org/50194 http://www.osvdb.org/50195 http://www.osvdb.org/50196 http://www.osvdb.org/50197 http://www.osvdb.org/50198 http://www.securityf • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2008-6968 – Pligg CMS 9.9.0 - Cross-Site Scripting / Local File Inclusion / SQL Injection
https://notcve.org/view.php?id=CVE-2008-6968
Multiple SQL injection vulnerabilities in submit.php in Pligg CMS 9.9.5 allow remote attackers to execute arbitrary SQL commands via the (1) category and (2) id parameters. Vulnerabilidad múltiple de inyección SQL en submit.php en Pligg CMS v9.9.5 permite a los atacantes remotos ejecutar arbitrariamente comandos SQL a través de los parámetros (1) category y (2) id. • https://www.exploit-db.com/exploits/6173 http://www.digitrustgroup.com/advisories/web-application-security-pligg http://www.securityfocus.com/bid/31062 https://exchange.xforce.ibmcloud.com/vulnerabilities/45086 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2008-5739 – Pligg 9.9.5b - Arbitrary File Upload / SQL Injection
https://notcve.org/view.php?id=CVE-2008-5739
SQL injection vulnerability in evb/check_url.php in Pligg CMS 9.9.5 Beta allows remote attackers to execute arbitrary SQL commands via the url parameter. Vulnerabilidad de inyección SQL en evb/check_url.php en Pligg CMS 9.9.5 Beta permite a atacantes remotos ejecutar comandos SQL de su elección mediante el parámetro url. • https://www.exploit-db.com/exploits/7544 http://osvdb.org/50913 http://securityreason.com/securityalert/4817 http://www.securityfocus.com/bid/32970 https://exchange.xforce.ibmcloud.com/vulnerabilities/47571 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 5.0EPSS: 0%CPEs: 2EXPL: 3CVE-2008-3573 – Pligg CMS 9.9.5 - 'CAPTCHA' Registration Automation Security Bypass
https://notcve.org/view.php?id=CVE-2008-3573
The CAPTCHA implementation in (1) Pligg 9.9.5 and possibly (2) Francisco Burzi PHP-Nuke 8.1 provides a critical random number (the ts_random value) within the URL in the SRC attribute of an IMG element, which allows remote attackers to pass the CAPTCHA test via a calculation that combines this value with the current date and the HTTP User-Agent string. La implementación CAPTCHA en (1) Pligg 9.9.5 y posiblemente (2) Francisco Burzi PHP-Nuke 8.1, proporciona un número aleatorio crítico (el valor del ts_random) dentro de la URL en el traibuto SRC de un elemento IMG, lo que permite a atacantes remotos evitar el test CAPTCHA mediante un cálculo que combina ese valor con la fecha actual y la cadena HTTP del User-Agent. • https://www.exploit-db.com/exploits/32142 http://www.rooksecurity.com/blog/?p=17 http://www.securityfocus.com/bid/30518 https://exchange.xforce.ibmcloud.com/vulnerabilities/44192 • CWE-189: Numeric Errors CWE-264: Permissions, Privileges, and Access Controls •