CVSS: 7.5EPSS: 1%CPEs: 2EXPL: 4CVE-2009-4679 – Joomla! Component com_if_nexus - Remote File Inclusion
https://notcve.org/view.php?id=CVE-2009-4679
Directory traversal vulnerability in the inertialFATE iF Portfolio Nexus (com_if_nexus) component 1.5 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the controller parameter to index.php. Vulnerabilidad de salto de directorio en el componente para Joomla! inertialFATE iF Portfolio Nexus (com_if_nexus), permite a atacantes remotos incluir y ejecutar ficheros locales de su elección al utilizar caracteres .. • https://www.exploit-db.com/exploits/10754 https://www.exploit-db.com/exploits/33440 http://secunia.com/advisories/37760 http://www.exploit-db.com/exploits/10754 http://www.osvdb.org/61382 http://www.securityfocus.com/bid/37473 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 3CVE-2009-4057 – Joomla! Extension iF Portfolio Nexus - SQL Injection
https://notcve.org/view.php?id=CVE-2009-4057
SQL injection vulnerability in the inertialFATE iF Portfolio Nexus (com_if_nexus) component 1.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in an item action to index.php. Una vulnerabilidad de inyección SQL en el componente de Joomla! inertialFATE iF Portfolio Nexus (com_if_nexus) 1.1 permite a atacantes remotos ejecutar comandos SQL a través del parámetro id en una acción de elemento a index.php. • https://www.exploit-db.com/exploits/10177 http://osvdb.org/60308 http://secunia.com/advisories/37408 http://www.packetstormsecurity.org/0911-exploits/joomlanexus-sql.txt http://www.securityfocus.com/bid/37050 https://exchange.xforce.ibmcloud.com/vulnerabilities/54325 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •