3 results (0.004 seconds)

CVSS: 8.8EPSS: 1%CPEs: 1EXPL: 4

CVE-2012-5865 – Achievo 1.4.5 - Multiple Vulnerabilities

https://notcve.org/view.php?id=CVE-2012-5865

20 Oct 2014 — SQL injection vulnerability in dispatch.php in Achievo 1.4.5 allows remote authenticated users to execute arbitrary SQL commands via the activityid parameter in a stats action. Vulnerabilidad de inyección SQL en dispatch.php en Achievo 1.4.5 permite a usuarios remotos autenticados ejecutar comandos SQL arbitrarios a través del parámetro activityid en una acción stats. • https://www.exploit-db.com/exploits/23253 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •

CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 3

CVE-2012-5866

https://notcve.org/view.php?id=CVE-2012-5866

20 Oct 2014 — Cross-site scripting (XSS) vulnerability in include.php in Achievo 1.4.5 allows remote attackers to inject arbitrary web script or HTML via the field parameter. Vulnerabilidad de XSS en include.php en Achievo 1.4.5 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través del parámetro field. • http://packetstormsecurity.com/files/118673/Achievo-1.4.5-Cross-Site-Scripting-SQL-Injection.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 1

CVE-2011-3697

https://notcve.org/view.php?id=CVE-2011-3697

23 Sep 2011 — Achievo 1.4.5 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by modules/graph/jpgraph/jpgraph_radar.php and certain other files. Achievo v1.4.5 permite a atacantes remotos obtener información sensible a través de una petición directa a un archivo .php, lo que revela la ruta de instalación en un mensaje de error, como se demostró con modules/graph/jpgraph/jpgraph_radar.php y algunos otros ar... • http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •