4 results (0.014 seconds)

CVSS: 7.5EPSS: 1%CPEs: 1EXPL: 1

CVE-2006-4213 – Thatware 0.4.6 - 'ROOT_PATH' Remote File Inclusion

https://notcve.org/view.php?id=CVE-2006-4213

PHP remote file inclusion vulnerability in config.php in David Kent Norman Thatware 0.4.6 and possibly earlier allows remote attackers to execute arbitrary PHP code via a URL in the root_path parameter. Vulnerabilidad de inclusión remota de archivo en PHP en config.php en David Kent Norman Thatware 0.4.6 y posiblemente anetriores permite a atacantes remotos ejecutar código PHP de su elección mediante una URL en el parámetro root_path. • https://www.exploit-db.com/exploits/2166 http://www.vupen.com/english/advisories/2006/3257 https://exchange.xforce.ibmcloud.com/vulnerabilities/28313 •

CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 3

CVE-2002-2298 – Thatware 0.4.6 - 'ROOT_PATH' Remote File Inclusion

https://notcve.org/view.php?id=CVE-2002-2298

PHP remote file inclusion vulnerability in config.php in Thatware 0.3 through 0.5.3 allows remote attackers to execute arbitrary PHP code via the root_path parameter. • https://www.exploit-db.com/exploits/2166 http://archives.neohapsis.com/archives/bugtraq/2002-12/0000.html http://securitytracker.com/id?1005733 https://exchange.xforce.ibmcloud.com/vulnerabilities/10758 • CWE-94: Improper Control of Generation of Code ('Code Injection') •

CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 2

CVE-2002-2299

https://notcve.org/view.php?id=CVE-2002-2299

PHP remote file inclusion vulnerability in thatfile.php in Thatware 0.3 through 0.5.2 allows remote attackers to execute arbitrary PHP code via the root_path parameter. • http://archives.neohapsis.com/archives/bugtraq/2002-12/0000.html http://securitytracker.com/id?1005733 https://exchange.xforce.ibmcloud.com/vulnerabilities/10758 • CWE-94: Improper Control of Generation of Code ('Code Injection') •

CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 2

CVE-2002-2252

https://notcve.org/view.php?id=CVE-2002-2252

SQL injection vulnerability in auth.inc.php in Thatware 0.5.0 and earlier allows remote attackers to execute arbitrary SQL commands via a base64-encoded user parameter. • http://archives.neohapsis.com/archives/bugtraq/2002-12/0000.html http://securitytracker.com/id?1005733 https://exchange.xforce.ibmcloud.com/vulnerabilities/10759 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •