CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 1CVE-2006-1956
https://notcve.org/view.php?id=CVE-2006-1956
21 Apr 2006 — The com_rss option (rss.php) in (1) Mambo and (2) Joomla! allows remote attackers to obtain sensitive information via an invalid feed parameter, which reveals the path in an error message. • http://irannetjob.com/content/view/209/28 •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 1CVE-2006-1957
https://notcve.org/view.php?id=CVE-2006-1957
21 Apr 2006 — The com_rss option (rss.php) in (1) Mambo and (2) Joomla! allows remote attackers to cause a denial of service (disk consumption and possibly web-server outage) via multiple requests with different values of the feed parameter. • http://archives.neohapsis.com/archives/bugtraq/2006-04/0380.html • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 1%CPEs: 16EXPL: 4CVE-2006-1794 – Mambo < 4.5.3h - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2006-1794
17 Apr 2006 — SQL injection vulnerability in Mambo 4.5.3, 4.5.3h, and possibly earlier versions allows remote attackers to execute arbitrary SQL commands via (1) the $username variable in the mosGetParam function and (2) the $task parameter in the mosMenuCheck function in (a) includes/mambo.php; and (3) the $filter variable to the showCategory function in the com_content component (content.php). • https://www.exploit-db.com/exploits/43835 •
CVSS: 9.1EPSS: 1%CPEs: 2EXPL: 1CVE-2006-0871 – Mambo < 4.5.3h - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2006-0871
24 Feb 2006 — Directory traversal vulnerability in the _setTemplate function in Mambo 4.5.3, 4.5.3h, and possibly earlier versions allows remote attackers to read and include arbitrary files via the mos_change_template parameter. NOTE: CVE-2006-1794 has been assigned to the SQL injection vector. • https://www.exploit-db.com/exploits/43835 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.4EPSS: 0%CPEs: 6EXPL: 0CVE-2005-4156
https://notcve.org/view.php?id=CVE-2005-4156
11 Dec 2005 — Unspecified vulnerability in Mambo 4.5 (1.0.0) through 4.5 (1.0.9), with magic_quotes_gpc disabled, allows remote attackers to read arbitrary files and possibly cause a denial of service via a query string that ends with a NULL character. • http://securitytracker.com/alerts/2005/Nov/1015176.html •
CVSS: 9.1EPSS: 7%CPEs: 10EXPL: 3CVE-2005-3738 – Mambo 4.5.2 - Globals Overwrite / Remote Command Execution
https://notcve.org/view.php?id=CVE-2005-3738
22 Nov 2005 — globals.php in Mambo Site Server 4.0.14 and earlier, when register_globals is disabled, allows remote attackers to overwrite variables in the GLOBALS array and conduct various attacks, as demonstrated using the mosConfig_absolute_path parameter to content.html.php for remote PHP file inclusion. globals.php en Mambo Site Server 4.0.14 y anteriores, cuando "register_globals" está desactivado, permite a atacantes remotos sobreescribir variables mediante el 'array' "GLOBALS" y llevar a cabo varios ataques, como... • https://www.exploit-db.com/exploits/1337 •
CVSS: 5.3EPSS: 0%CPEs: 4EXPL: 1CVE-2005-3586
https://notcve.org/view.php?id=CVE-2005-3586
16 Nov 2005 — content.php in Mambo 4.5.2 through 4.5.2.3 allows remote attackers to obtain the installation path of the application via a URL that causes the application to return an error. • http://irannetjob.com/content/view/153/28 •
CVSS: 9.8EPSS: 1%CPEs: 6EXPL: 1CVE-2005-2002 – Mambo 4.5.2.1 - Fetch Password Hash
https://notcve.org/view.php?id=CVE-2005-2002
15 Jun 2005 — SQL injection vulnerability in content.php in Mambo 4.5.2.2 and earlier allows remote attackers to execute arbitrary SQL commands via the user_rating parameter. • https://www.exploit-db.com/exploits/1049 •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2005-0512
https://notcve.org/view.php?id=CVE-2005-0512
21 Feb 2005 — PHP remote file inclusion vulnerability in Tar.php in Mambo 4.5.2 allows remote attackers to execute arbitrary PHP code by modifying the mosConfig_absolute_path parameter to reference a URL on a remote web server that contains the code, a different vulnerability than CVE-2004-1693. • http://mamboforge.net/frs/download.php/4043/Patch_4.5.2_to_4.5.2.1.zip •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 3CVE-2004-2072 – Mambo Open Source 4.6 - 'Itemid' Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2004-2072
31 Dec 2004 — Cross-site scripting (XSS) vulnerability in index.php for Mambo Open Source 4.6, and possibly earlier versions, allows remote attackers to execute script on other clients via the Itemid parameter. • https://www.exploit-db.com/exploits/23657 •