4 results (0.005 seconds)

CVSS: 9.8EPSS: 3%CPEs: 1EXPL: 10

CVE-2006-3019 – phpCMS 1.1.7 - 'class.cache_PHPcms.php' Remote File Inclusion

https://notcve.org/view.php?id=CVE-2006-3019

15 Jun 2006 — Multiple PHP remote file inclusion vulnerabilities in phpCMS 1.2.1pl2 allow remote attackers to execute arbitrary PHP code via a URL in the PHPCMS_INCLUDEPATH parameter to files in parser/include/ including (1) class.parser_phpcms.php, (2) class.session_phpcms.php, (3) class.edit_phpcms.php, (4) class.http_indexer_phpcms.php, (5) class.cache_phpcms.php, (6) class.search_phpcms.php, (7) class.lib_indexer_universal_phpcms.php, and (8) class.layout_phpcms.php, (9) parser/plugs/counter.php, and (10) parser/pars... • https://www.exploit-db.com/exploits/29349 • CWE-94: Improper Control of Generation of Code ('Code Injection') •

CVSS: 7.5EPSS: 1%CPEs: 4EXPL: 0

CVE-2005-1840

https://notcve.org/view.php?id=CVE-2005-1840

02 Jun 2005 — Directory traversal vulnerability in class.layout_phpcms.php in phpCMS 1.2.x before 1.2.1pl2 allows remote attackers to read or include arbitrary files, as demonstrated using a .. (dot dot) in the language parameter to parser.php. • http://cvs.sourceforge.net/viewcvs.py/phpcms/phpcms/parser/include/class.layout_phpcms.php?rev=1.12.2.37&view=markup •

CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0

CVE-2004-1203

https://notcve.org/view.php?id=CVE-2004-1203

15 Dec 2004 — parser.php in phpCMS 1.2.1 and earlier, with non-stealth and debug modes enabled, allows remote attackers to gain sensitive information via an invalid file parameter, which reveals the web server's installation path. • http://lists.grok.org.uk/pipermail/full-disclosure/2004-November/029499.html •

CVSS: 6.8EPSS: 1%CPEs: 3EXPL: 1

CVE-2004-1202

https://notcve.org/view.php?id=CVE-2004-1202

15 Dec 2004 — Cross-site scripting (XSS) vulnerability in parser.php in phpCMS 1.2.1 and earlier, with non-stealth and debug modes enabled, allows remote attackers to inject arbitrary web script or HTML via the file parameter. • http://lists.grok.org.uk/pipermail/full-disclosure/2004-November/029499.html •