Search
Find a vulnerability
Search criteria
52 vulnerabilities found for php_fusion by php_fusion
CVE-2006-4673 (GCVE-0-2006-4673)
Vulnerability from nvd – Published: 2006-09-11 16:00 – Updated: 2024-08-07 19:23
VLAI
EPSS
VEX
Summary
Global variable overwrite vulnerability in maincore.php in PHP-Fusion 6.01.4 and earlier uses the extract function on the superglobals, which allows remote attackers to conduct SQL injection attacks via the _SERVER[REMOTE_ADDR] parameter to news.php.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
7 references
| URL | Tags |
|---|---|
| http://www.securityfocus.com/bid/19908 | vdb-entryx_refsource_BID |
| http://marc.info/?l=bugtraq&m=115765187519458&w=2 | mailing-listx_refsource_BUGTRAQ |
| http://www.vupen.com/english/advisories/2006/3523 | vdb-entryx_refsource_VUPEN |
| http://www.php-fusion.co.uk/news.php?readmore=353 | x_refsource_CONFIRM |
| http://retrogod.altervista.org/phpfusion_6-01-4_x… | x_refsource_MISC |
| https://exchange.xforce.ibmcloud.com/vulnerabilit… | vdb-entryx_refsource_XF |
| http://secunia.com/advisories/21830 | third-party-advisoryx_refsource_SECUNIA |
Date Public
2006-09-07 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T19:23:40.437Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "19908",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/19908"
},
{
"name": "20060907 PHPFusion \u003c= 6.01.4 extract()/_SERVER[REMOTE_ADDR] sql injection",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://marc.info/?l=bugtraq\u0026m=115765187519458\u0026w=2"
},
{
"name": "ADV-2006-3523",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2006/3523"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.php-fusion.co.uk/news.php?readmore=353"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://retrogod.altervista.org/phpfusion_6-01-4_xpl.html"
},
{
"name": "phpfusion-manicore-sql-injection(28818)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/28818"
},
{
"name": "21830",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/21830"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2006-09-07T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Global variable overwrite vulnerability in maincore.php in PHP-Fusion 6.01.4 and earlier uses the extract function on the superglobals, which allows remote attackers to conduct SQL injection attacks via the _SERVER[REMOTE_ADDR] parameter to news.php."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-19T15:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "19908",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/19908"
},
{
"name": "20060907 PHPFusion \u003c= 6.01.4 extract()/_SERVER[REMOTE_ADDR] sql injection",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://marc.info/?l=bugtraq\u0026m=115765187519458\u0026w=2"
},
{
"name": "ADV-2006-3523",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2006/3523"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.php-fusion.co.uk/news.php?readmore=353"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://retrogod.altervista.org/phpfusion_6-01-4_xpl.html"
},
{
"name": "phpfusion-manicore-sql-injection(28818)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/28818"
},
{
"name": "21830",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/21830"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2006-4673",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Global variable overwrite vulnerability in maincore.php in PHP-Fusion 6.01.4 and earlier uses the extract function on the superglobals, which allows remote attackers to conduct SQL injection attacks via the _SERVER[REMOTE_ADDR] parameter to news.php."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "19908",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/19908"
},
{
"name": "20060907 PHPFusion \u003c= 6.01.4 extract()/_SERVER[REMOTE_ADDR] sql injection",
"refsource": "BUGTRAQ",
"url": "http://marc.info/?l=bugtraq\u0026m=115765187519458\u0026w=2"
},
{
"name": "ADV-2006-3523",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2006/3523"
},
{
"name": "http://www.php-fusion.co.uk/news.php?readmore=353",
"refsource": "CONFIRM",
"url": "http://www.php-fusion.co.uk/news.php?readmore=353"
},
{
"name": "http://retrogod.altervista.org/phpfusion_6-01-4_xpl.html",
"refsource": "MISC",
"url": "http://retrogod.altervista.org/phpfusion_6-01-4_xpl.html"
},
{
"name": "phpfusion-manicore-sql-injection(28818)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/28818"
},
{
"name": "21830",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/21830"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2006-4673",
"datePublished": "2006-09-11T16:00:00.000Z",
"dateReserved": "2006-09-11T00:00:00.000Z",
"dateUpdated": "2024-08-07T19:23:40.437Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2006-3555 (GCVE-0-2006-3555)
Vulnerability from nvd – Published: 2006-07-13 00:00 – Updated: 2024-08-07 18:30
VLAI
EPSS
VEX
Summary
Multiple cross-site scripting (XSS) vulnerabilities in submit.php in PHP-Fusion before 6.01.3 allow remote attackers to inject arbitrary web script or HTML by using edit_profile.php to upload a (1) avatar or (2) forum image attachment that has a .gif or .jpg extension, and begins with a GIF header followed by JavaScript code, which is executed by Internet Explorer.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
7 references
| URL | Tags |
|---|---|
| http://www.securityfocus.com/archive/1/438938/100… | mailing-listx_refsource_BUGTRAQ |
| http://www.securityfocus.com/bid/18787 | vdb-entryx_refsource_BID |
| http://www.vupen.com/english/advisories/2006/2655 | vdb-entryx_refsource_VUPEN |
| http://securityreason.com/securityalert/1224 | third-party-advisoryx_refsource_SREASON |
| http://secunia.com/advisories/20904 | third-party-advisoryx_refsource_SECUNIA |
| https://exchange.xforce.ibmcloud.com/vulnerabilit… | vdb-entryx_refsource_XF |
| http://php-fusion.co.uk/news.php | x_refsource_CONFIRM |
Date Public
2006-06-28 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T18:30:34.447Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20060701 Php-Fusion (Xss) With Avatar Upload",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/438938/100/0/threaded"
},
{
"name": "18787",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/18787"
},
{
"name": "ADV-2006-2655",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2006/2655"
},
{
"name": "1224",
"tags": [
"third-party-advisory",
"x_refsource_SREASON",
"x_transferred"
],
"url": "http://securityreason.com/securityalert/1224"
},
{
"name": "20904",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/20904"
},
{
"name": "phpfusion-avatar-xss(27537)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/27537"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://php-fusion.co.uk/news.php"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2006-06-28T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in submit.php in PHP-Fusion before 6.01.3 allow remote attackers to inject arbitrary web script or HTML by using edit_profile.php to upload a (1) avatar or (2) forum image attachment that has a .gif or .jpg extension, and begins with a GIF header followed by JavaScript code, which is executed by Internet Explorer."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-18T14:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "20060701 Php-Fusion (Xss) With Avatar Upload",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/438938/100/0/threaded"
},
{
"name": "18787",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/18787"
},
{
"name": "ADV-2006-2655",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2006/2655"
},
{
"name": "1224",
"tags": [
"third-party-advisory",
"x_refsource_SREASON"
],
"url": "http://securityreason.com/securityalert/1224"
},
{
"name": "20904",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/20904"
},
{
"name": "phpfusion-avatar-xss(27537)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/27537"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://php-fusion.co.uk/news.php"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2006-3555",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in submit.php in PHP-Fusion before 6.01.3 allow remote attackers to inject arbitrary web script or HTML by using edit_profile.php to upload a (1) avatar or (2) forum image attachment that has a .gif or .jpg extension, and begins with a GIF header followed by JavaScript code, which is executed by Internet Explorer."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20060701 Php-Fusion (Xss) With Avatar Upload",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/438938/100/0/threaded"
},
{
"name": "18787",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/18787"
},
{
"name": "ADV-2006-2655",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2006/2655"
},
{
"name": "1224",
"refsource": "SREASON",
"url": "http://securityreason.com/securityalert/1224"
},
{
"name": "20904",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/20904"
},
{
"name": "phpfusion-avatar-xss(27537)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/27537"
},
{
"name": "http://php-fusion.co.uk/news.php",
"refsource": "CONFIRM",
"url": "http://php-fusion.co.uk/news.php"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2006-3555",
"datePublished": "2006-07-13T00:00:00.000Z",
"dateReserved": "2006-07-12T00:00:00.000Z",
"dateUpdated": "2024-08-07T18:30:34.447Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2006-2459 (GCVE-0-2006-2459)
Vulnerability from nvd – Published: 2006-05-19 10:00 – Updated: 2024-08-07 17:51
VLAI
EPSS
VEX
Summary
SQL injection vulnerability in messages.php in PHP-Fusion 6.00.307 and earlier allows remote authenticated users to execute arbitrary SQL commands via the srch_where parameter.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://exchange.xforce.ibmcloud.com/vulnerabilit… | vdb-entryx_refsource_XF |
| http://www.securityfocus.com/bid/18009 | vdb-entryx_refsource_BID |
| http://securityreason.com/securityalert/922 | third-party-advisoryx_refsource_SREASON |
| http://www.securityfocus.com/archive/1/434162/100… | mailing-listx_refsource_BUGTRAQ |
| http://www.osvdb.org/25542 | vdb-entryx_refsource_OSVDB |
| http://secunia.com/advisories/20129 | third-party-advisoryx_refsource_SECUNIA |
| http://retrogod.altervista.org/phpfusion_600306_s… | x_refsource_MISC |
| http://securitytracker.com/id?1016111 | vdb-entryx_refsource_SECTRACK |
| http://www.vupen.com/english/advisories/2006/1839 | vdb-entryx_refsource_VUPEN |
Date Public
2006-05-16 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T17:51:04.896Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "phpfusion-srchwhere-sql-injection(26491)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26491"
},
{
"name": "18009",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/18009"
},
{
"name": "922",
"tags": [
"third-party-advisory",
"x_refsource_SREASON",
"x_transferred"
],
"url": "http://securityreason.com/securityalert/922"
},
{
"name": "20060516 PHP-Fusion \u003c= 6.00.306 \"srch_where\" SQL injection / admin credentials disclosure",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/434162/100/0/threaded"
},
{
"name": "25542",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/25542"
},
{
"name": "20129",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/20129"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://retrogod.altervista.org/phpfusion_600306_sql.html"
},
{
"name": "1016111",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1016111"
},
{
"name": "ADV-2006-1839",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2006/1839"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2006-05-16T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "SQL injection vulnerability in messages.php in PHP-Fusion 6.00.307 and earlier allows remote authenticated users to execute arbitrary SQL commands via the srch_where parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-18T14:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "phpfusion-srchwhere-sql-injection(26491)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26491"
},
{
"name": "18009",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/18009"
},
{
"name": "922",
"tags": [
"third-party-advisory",
"x_refsource_SREASON"
],
"url": "http://securityreason.com/securityalert/922"
},
{
"name": "20060516 PHP-Fusion \u003c= 6.00.306 \"srch_where\" SQL injection / admin credentials disclosure",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/434162/100/0/threaded"
},
{
"name": "25542",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/25542"
},
{
"name": "20129",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/20129"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://retrogod.altervista.org/phpfusion_600306_sql.html"
},
{
"name": "1016111",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1016111"
},
{
"name": "ADV-2006-1839",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2006/1839"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2006-2459",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "SQL injection vulnerability in messages.php in PHP-Fusion 6.00.307 and earlier allows remote authenticated users to execute arbitrary SQL commands via the srch_where parameter."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "phpfusion-srchwhere-sql-injection(26491)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26491"
},
{
"name": "18009",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/18009"
},
{
"name": "922",
"refsource": "SREASON",
"url": "http://securityreason.com/securityalert/922"
},
{
"name": "20060516 PHP-Fusion \u003c= 6.00.306 \"srch_where\" SQL injection / admin credentials disclosure",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/434162/100/0/threaded"
},
{
"name": "25542",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/25542"
},
{
"name": "20129",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/20129"
},
{
"name": "http://retrogod.altervista.org/phpfusion_600306_sql.html",
"refsource": "MISC",
"url": "http://retrogod.altervista.org/phpfusion_600306_sql.html"
},
{
"name": "1016111",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1016111"
},
{
"name": "ADV-2006-1839",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2006/1839"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2006-2459",
"datePublished": "2006-05-19T10:00:00.000Z",
"dateReserved": "2006-05-19T00:00:00.000Z",
"dateUpdated": "2024-08-07T17:51:04.896Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2006-2330 (GCVE-0-2006-2330)
Vulnerability from nvd – Published: 2006-05-12 00:00 – Updated: 2024-08-07 17:43
VLAI
EPSS
VEX
Summary
PHP-Fusion 6.00.306 and earlier, running under Apache HTTP Server 1.3.27 and PHP 4.3.3, allows remote authenticated users to upload files of arbitrary types using a filename that contains two or more extensions that ends in an assumed-valid extension such as .gif, which bypasses the validation, as demonstrated by uploading then executing an avatar file that ends in ".php.gif" and contains PHP code in EXIF metadata.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
8 references
| URL | Tags |
|---|---|
| http://securityreason.com/securityalert/873 | third-party-advisoryx_refsource_SREASON |
| http://www.php-fusion.co.uk/news.php | x_refsource_CONFIRM |
| https://exchange.xforce.ibmcloud.com/vulnerabilit… | vdb-entryx_refsource_XF |
| http://www.osvdb.org/25537 | vdb-entryx_refsource_OSVDB |
| http://www.securityfocus.com/archive/1/433277/100… | mailing-listx_refsource_BUGTRAQ |
| http://secunia.com/advisories/19992 | third-party-advisoryx_refsource_SECUNIA |
| http://www.securityfocus.com/bid/17898 | vdb-entryx_refsource_BID |
| http://www.vupen.com/english/advisories/2006/1735 | vdb-entryx_refsource_VUPEN |
Date Public
2006-05-08 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T17:43:29.179Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "873",
"tags": [
"third-party-advisory",
"x_refsource_SREASON",
"x_transferred"
],
"url": "http://securityreason.com/securityalert/873"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.php-fusion.co.uk/news.php"
},
{
"name": "phpfusion-avatar-extensions-code-execution(26388)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26388"
},
{
"name": "25537",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/25537"
},
{
"name": "20060508 PHPFusion \u003c= v6.00.306 avatar mod_mime arbitrary file upload \u0026 local inclusion vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/433277/100/0/threaded"
},
{
"name": "19992",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/19992"
},
{
"name": "17898",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/17898"
},
{
"name": "ADV-2006-1735",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2006/1735"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2006-05-08T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "PHP-Fusion 6.00.306 and earlier, running under Apache HTTP Server 1.3.27 and PHP 4.3.3, allows remote authenticated users to upload files of arbitrary types using a filename that contains two or more extensions that ends in an assumed-valid extension such as .gif, which bypasses the validation, as demonstrated by uploading then executing an avatar file that ends in \".php.gif\" and contains PHP code in EXIF metadata."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-18T14:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "873",
"tags": [
"third-party-advisory",
"x_refsource_SREASON"
],
"url": "http://securityreason.com/securityalert/873"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.php-fusion.co.uk/news.php"
},
{
"name": "phpfusion-avatar-extensions-code-execution(26388)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26388"
},
{
"name": "25537",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/25537"
},
{
"name": "20060508 PHPFusion \u003c= v6.00.306 avatar mod_mime arbitrary file upload \u0026 local inclusion vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/433277/100/0/threaded"
},
{
"name": "19992",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/19992"
},
{
"name": "17898",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/17898"
},
{
"name": "ADV-2006-1735",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2006/1735"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2006-2330",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "PHP-Fusion 6.00.306 and earlier, running under Apache HTTP Server 1.3.27 and PHP 4.3.3, allows remote authenticated users to upload files of arbitrary types using a filename that contains two or more extensions that ends in an assumed-valid extension such as .gif, which bypasses the validation, as demonstrated by uploading then executing an avatar file that ends in \".php.gif\" and contains PHP code in EXIF metadata."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "873",
"refsource": "SREASON",
"url": "http://securityreason.com/securityalert/873"
},
{
"name": "http://www.php-fusion.co.uk/news.php",
"refsource": "CONFIRM",
"url": "http://www.php-fusion.co.uk/news.php"
},
{
"name": "phpfusion-avatar-extensions-code-execution(26388)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26388"
},
{
"name": "25537",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/25537"
},
{
"name": "20060508 PHPFusion \u003c= v6.00.306 avatar mod_mime arbitrary file upload \u0026 local inclusion vulnerabilities",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/433277/100/0/threaded"
},
{
"name": "19992",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/19992"
},
{
"name": "17898",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/17898"
},
{
"name": "ADV-2006-1735",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2006/1735"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2006-2330",
"datePublished": "2006-05-12T00:00:00.000Z",
"dateReserved": "2006-05-11T00:00:00.000Z",
"dateUpdated": "2024-08-07T17:43:29.179Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2006-2331 (GCVE-0-2006-2331)
Vulnerability from nvd – Published: 2006-05-12 00:00 – Updated: 2024-08-07 17:43
VLAI
EPSS
VEX
Summary
Multiple directory traversal vulnerabilities in PHP-Fusion 6.00.306 allow remote attackers to include and execute arbitrary local files via (1) a .. (dot dot) in the settings[locale] parameter in infusions/last_seen_users_panel/last_seen_users_panel.php, and (2) a .. (dot dot) in the localeset parameter in setup.php. NOTE: the vendor states that this issue might exist due to problems in third party local files.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
11 references
| URL | Tags |
|---|---|
| http://securityreason.com/securityalert/873 | third-party-advisoryx_refsource_SREASON |
| http://www.php-fusion.co.uk/news.php | x_refsource_CONFIRM |
| https://exchange.xforce.ibmcloud.com/vulnerabilit… | vdb-entryx_refsource_XF |
| http://www.osvdb.org/25539 | vdb-entryx_refsource_OSVDB |
| http://www.securityfocus.com/archive/1/433277/100… | mailing-listx_refsource_BUGTRAQ |
| http://securityreason.com/securityalert/194 | third-party-advisoryx_refsource_SREASON |
| http://secunia.com/advisories/19992 | third-party-advisoryx_refsource_SECUNIA |
| http://www.securityfocus.com/bid/17898 | vdb-entryx_refsource_BID |
| http://www.osvdb.org/25538 | vdb-entryx_refsource_OSVDB |
| http://www.vupen.com/english/advisories/2006/1735 | vdb-entryx_refsource_VUPEN |
| http://www.php-fusion.co.uk/news.php?readmore=321 | x_refsource_CONFIRM |
Date Public
2006-05-08 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T17:43:29.285Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "873",
"tags": [
"third-party-advisory",
"x_refsource_SREASON",
"x_transferred"
],
"url": "http://securityreason.com/securityalert/873"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.php-fusion.co.uk/news.php"
},
{
"name": "phpfusion-lastseenuserspanel-file-include(26389)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26389"
},
{
"name": "25539",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/25539"
},
{
"name": "20060508 PHPFusion \u003c= v6.00.306 avatar mod_mime arbitrary file upload \u0026 local inclusion vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/433277/100/0/threaded"
},
{
"name": "194",
"tags": [
"third-party-advisory",
"x_refsource_SREASON",
"x_transferred"
],
"url": "http://securityreason.com/securityalert/194"
},
{
"name": "19992",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/19992"
},
{
"name": "17898",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/17898"
},
{
"name": "25538",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/25538"
},
{
"name": "ADV-2006-1735",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2006/1735"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.php-fusion.co.uk/news.php?readmore=321"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2006-05-08T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Multiple directory traversal vulnerabilities in PHP-Fusion 6.00.306 allow remote attackers to include and execute arbitrary local files via (1) a .. (dot dot) in the settings[locale] parameter in infusions/last_seen_users_panel/last_seen_users_panel.php, and (2) a .. (dot dot) in the localeset parameter in setup.php. NOTE: the vendor states that this issue might exist due to problems in third party local files."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-18T14:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "873",
"tags": [
"third-party-advisory",
"x_refsource_SREASON"
],
"url": "http://securityreason.com/securityalert/873"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.php-fusion.co.uk/news.php"
},
{
"name": "phpfusion-lastseenuserspanel-file-include(26389)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26389"
},
{
"name": "25539",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/25539"
},
{
"name": "20060508 PHPFusion \u003c= v6.00.306 avatar mod_mime arbitrary file upload \u0026 local inclusion vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/433277/100/0/threaded"
},
{
"name": "194",
"tags": [
"third-party-advisory",
"x_refsource_SREASON"
],
"url": "http://securityreason.com/securityalert/194"
},
{
"name": "19992",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/19992"
},
{
"name": "17898",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/17898"
},
{
"name": "25538",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/25538"
},
{
"name": "ADV-2006-1735",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2006/1735"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.php-fusion.co.uk/news.php?readmore=321"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2006-2331",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple directory traversal vulnerabilities in PHP-Fusion 6.00.306 allow remote attackers to include and execute arbitrary local files via (1) a .. (dot dot) in the settings[locale] parameter in infusions/last_seen_users_panel/last_seen_users_panel.php, and (2) a .. (dot dot) in the localeset parameter in setup.php. NOTE: the vendor states that this issue might exist due to problems in third party local files."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "873",
"refsource": "SREASON",
"url": "http://securityreason.com/securityalert/873"
},
{
"name": "http://www.php-fusion.co.uk/news.php",
"refsource": "CONFIRM",
"url": "http://www.php-fusion.co.uk/news.php"
},
{
"name": "phpfusion-lastseenuserspanel-file-include(26389)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26389"
},
{
"name": "25539",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/25539"
},
{
"name": "20060508 PHPFusion \u003c= v6.00.306 avatar mod_mime arbitrary file upload \u0026 local inclusion vulnerabilities",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/433277/100/0/threaded"
},
{
"name": "194",
"refsource": "SREASON",
"url": "http://securityreason.com/securityalert/194"
},
{
"name": "19992",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/19992"
},
{
"name": "17898",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/17898"
},
{
"name": "25538",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/25538"
},
{
"name": "ADV-2006-1735",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2006/1735"
},
{
"name": "http://www.php-fusion.co.uk/news.php?readmore=321",
"refsource": "CONFIRM",
"url": "http://www.php-fusion.co.uk/news.php?readmore=321"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2006-2331",
"datePublished": "2006-05-12T00:00:00.000Z",
"dateReserved": "2006-05-11T00:00:00.000Z",
"dateUpdated": "2024-08-07T17:43:29.285Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2006-0593 (GCVE-0-2006-0593)
Vulnerability from nvd – Published: 2006-02-08 01:00 – Updated: 2024-08-07 16:41
VLAI
EPSS
VEX
Summary
Cross-site scripting (XSS) vulnerability in PHP-Fusion before 6.00.304 allows remote attackers to inject arbitrary web script or HTML via the (1) shout_name field in shoutbox_panel.php and the (2) comments field in comments_include.php.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://exchange.xforce.ibmcloud.com/vulnerabilit… | vdb-entryx_refsource_XF |
| http://www.php-fusion.co.uk/news.php?readmore=307 | x_refsource_CONFIRM |
| http://www.vupen.com/english/advisories/2006/0463 | vdb-entryx_refsource_VUPEN |
| http://www.securityfocus.com/bid/16548 | vdb-entryx_refsource_BID |
| http://www.php-fusion.co.uk/downloads.php?cat_id=3 | x_refsource_CONFIRM |
| http://secunia.com/advisories/18949 | third-party-advisoryx_refsource_SECUNIA |
| http://www.osvdb.org/22981 | vdb-entryx_refsource_OSVDB |
| http://www.osvdb.org/22980 | vdb-entryx_refsource_OSVDB |
Date Public
2006-02-05 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T16:41:28.992Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "phpfusion-multiple-xss(24548)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24548"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.php-fusion.co.uk/news.php?readmore=307"
},
{
"name": "ADV-2006-0463",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2006/0463"
},
{
"name": "16548",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/16548"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.php-fusion.co.uk/downloads.php?cat_id=3"
},
{
"name": "18949",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/18949"
},
{
"name": "22981",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/22981"
},
{
"name": "22980",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/22980"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2006-02-05T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in PHP-Fusion before 6.00.304 allows remote attackers to inject arbitrary web script or HTML via the (1) shout_name field in shoutbox_panel.php and the (2) comments field in comments_include.php."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-19T15:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "phpfusion-multiple-xss(24548)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24548"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.php-fusion.co.uk/news.php?readmore=307"
},
{
"name": "ADV-2006-0463",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2006/0463"
},
{
"name": "16548",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/16548"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.php-fusion.co.uk/downloads.php?cat_id=3"
},
{
"name": "18949",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/18949"
},
{
"name": "22981",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/22981"
},
{
"name": "22980",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/22980"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2006-0593",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in PHP-Fusion before 6.00.304 allows remote attackers to inject arbitrary web script or HTML via the (1) shout_name field in shoutbox_panel.php and the (2) comments field in comments_include.php."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "phpfusion-multiple-xss(24548)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24548"
},
{
"name": "http://www.php-fusion.co.uk/news.php?readmore=307",
"refsource": "CONFIRM",
"url": "http://www.php-fusion.co.uk/news.php?readmore=307"
},
{
"name": "ADV-2006-0463",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2006/0463"
},
{
"name": "16548",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/16548"
},
{
"name": "http://www.php-fusion.co.uk/downloads.php?cat_id=3",
"refsource": "CONFIRM",
"url": "http://www.php-fusion.co.uk/downloads.php?cat_id=3"
},
{
"name": "18949",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/18949"
},
{
"name": "22981",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/22981"
},
{
"name": "22980",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/22980"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2006-0593",
"datePublished": "2006-02-08T01:00:00.000Z",
"dateReserved": "2006-02-08T00:00:00.000Z",
"dateUpdated": "2024-08-07T16:41:28.992Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2005-4655 (GCVE-0-2005-4655)
Vulnerability from nvd – Published: 2006-01-16 21:00 – Updated: 2024-08-07 23:53
VLAI
EPSS
VEX
Summary
Cross-site scripting (XSS) vulnerability in submit.php in PHP-Fusion 6.0.204 allows remote attackers to inject arbitrary web script or HTML via nested tags in the news_body parameter, as demonstrated by elements such as "<me<meta>ta" and "<sc<script>ript>".
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
4 references
| URL | Tags |
|---|---|
| http://www.vupen.com/english/advisories/2005/2192 | vdb-entryx_refsource_VUPEN |
| http://securityreason.com/securityalert/106 | third-party-advisoryx_refsource_SREASON |
| http://secunia.com/advisories/17312 | third-party-advisoryx_refsource_SECUNIA |
| http://archives.neohapsis.com/archives/bugtraq/20… | mailing-listx_refsource_BUGTRAQ |
Date Public
2005-10-24 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T23:53:28.503Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "ADV-2005-2192",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2005/2192"
},
{
"name": "106",
"tags": [
"third-party-advisory",
"x_refsource_SREASON",
"x_transferred"
],
"url": "http://securityreason.com/securityalert/106"
},
{
"name": "17312",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/17312"
},
{
"name": "20051024 Possible Bug in PHP-Fusion 6.0.204",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2005-10/0272.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2005-10-24T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in submit.php in PHP-Fusion 6.0.204 allows remote attackers to inject arbitrary web script or HTML via nested tags in the news_body parameter, as demonstrated by elements such as \"\u003cme\u003cmeta\u003eta\" and \"\u003csc\u003cscript\u003eript\u003e\"."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2007-08-22T09:00:00.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "ADV-2005-2192",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2005/2192"
},
{
"name": "106",
"tags": [
"third-party-advisory",
"x_refsource_SREASON"
],
"url": "http://securityreason.com/securityalert/106"
},
{
"name": "17312",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/17312"
},
{
"name": "20051024 Possible Bug in PHP-Fusion 6.0.204",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2005-10/0272.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2005-4655",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in submit.php in PHP-Fusion 6.0.204 allows remote attackers to inject arbitrary web script or HTML via nested tags in the news_body parameter, as demonstrated by elements such as \"\u003cme\u003cmeta\u003eta\" and \"\u003csc\u003cscript\u003eript\u003e\"."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "ADV-2005-2192",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2005/2192"
},
{
"name": "106",
"refsource": "SREASON",
"url": "http://securityreason.com/securityalert/106"
},
{
"name": "17312",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/17312"
},
{
"name": "20051024 Possible Bug in PHP-Fusion 6.0.204",
"refsource": "BUGTRAQ",
"url": "http://archives.neohapsis.com/archives/bugtraq/2005-10/0272.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2005-4655",
"datePublished": "2006-01-16T21:00:00.000Z",
"dateReserved": "2006-01-16T00:00:00.000Z",
"dateUpdated": "2024-08-07T23:53:28.503Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2005-4516 (GCVE-0-2005-4516)
Vulnerability from nvd – Published: 2005-12-28 01:00 – Updated: 2024-08-07 23:46
VLAI
EPSS
VEX
Summary
Multiple cross-site scripting (XSS) vulnerabilities in PHP-Fusion 6.00.200 through 6.00.300 allow remote attackers to inject arbitrary web script or HTML via (1) the sortby parameter in members.php and (2) IMG tags.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
7 references
| URL | Tags |
|---|---|
| http://www.vupen.com/english/advisories/2005/3063 | vdb-entryx_refsource_VUPEN |
| http://www.osvdb.org/22050 | vdb-entryx_refsource_OSVDB |
| http://www.osvdb.org/22048 | vdb-entryx_refsource_OSVDB |
| http://securityreason.com/securityalert/272 | third-party-advisoryx_refsource_SREASON |
| http://www.securityfocus.com/bid/15931 | vdb-entryx_refsource_BID |
| http://secunia.com/advisories/18190/ | third-party-advisoryx_refsource_SECUNIA |
| http://www.securityfocus.com/archive/1/420109/100… | mailing-listx_refsource_BUGTRAQ |
Date Public
2005-12-22 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T23:46:05.512Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "ADV-2005-3063",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2005/3063"
},
{
"name": "22050",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/22050"
},
{
"name": "22048",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/22048"
},
{
"name": "272",
"tags": [
"third-party-advisory",
"x_refsource_SREASON",
"x_transferred"
],
"url": "http://securityreason.com/securityalert/272"
},
{
"name": "15931",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/15931"
},
{
"name": "18190",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/18190/"
},
{
"name": "20051222 XSS\u0026Sql injection attack in PHP-Fusion 6.00.3 Released",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/420109/100/0/threaded"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2005-12-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in PHP-Fusion 6.00.200 through 6.00.300 allow remote attackers to inject arbitrary web script or HTML via (1) the sortby parameter in members.php and (2) IMG tags."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-19T14:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "ADV-2005-3063",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2005/3063"
},
{
"name": "22050",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/22050"
},
{
"name": "22048",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/22048"
},
{
"name": "272",
"tags": [
"third-party-advisory",
"x_refsource_SREASON"
],
"url": "http://securityreason.com/securityalert/272"
},
{
"name": "15931",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/15931"
},
{
"name": "18190",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/18190/"
},
{
"name": "20051222 XSS\u0026Sql injection attack in PHP-Fusion 6.00.3 Released",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/420109/100/0/threaded"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2005-4516",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in PHP-Fusion 6.00.200 through 6.00.300 allow remote attackers to inject arbitrary web script or HTML via (1) the sortby parameter in members.php and (2) IMG tags."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "ADV-2005-3063",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2005/3063"
},
{
"name": "22050",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/22050"
},
{
"name": "22048",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/22048"
},
{
"name": "272",
"refsource": "SREASON",
"url": "http://securityreason.com/securityalert/272"
},
{
"name": "15931",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/15931"
},
{
"name": "18190",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/18190/"
},
{
"name": "20051222 XSS\u0026Sql injection attack in PHP-Fusion 6.00.3 Released",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/420109/100/0/threaded"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2005-4516",
"datePublished": "2005-12-28T01:00:00.000Z",
"dateReserved": "2005-12-28T00:00:00.000Z",
"dateUpdated": "2024-08-07T23:46:05.512Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2005-4517 (GCVE-0-2005-4517)
Vulnerability from nvd – Published: 2005-12-28 01:00 – Updated: 2024-08-07 23:46
VLAI
EPSS
VEX
Summary
SQL injection vulnerability in PHP-Fusion 6.00.200 through 6.00.300 allows remote attackers to execute arbitrary SQL commands via the ratings parameter in multiple scripts, such as ratings_include.php.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
5 references
| URL | Tags |
|---|---|
| http://www.vupen.com/english/advisories/2005/3063 | vdb-entryx_refsource_VUPEN |
| http://www.osvdb.org/22049 | vdb-entryx_refsource_OSVDB |
| http://securityreason.com/securityalert/272 | third-party-advisoryx_refsource_SREASON |
| http://secunia.com/advisories/18190/ | third-party-advisoryx_refsource_SECUNIA |
| http://www.securityfocus.com/archive/1/420109/100… | mailing-listx_refsource_BUGTRAQ |
Date Public
2005-12-22 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T23:46:05.541Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "ADV-2005-3063",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2005/3063"
},
{
"name": "22049",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/22049"
},
{
"name": "272",
"tags": [
"third-party-advisory",
"x_refsource_SREASON",
"x_transferred"
],
"url": "http://securityreason.com/securityalert/272"
},
{
"name": "18190",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/18190/"
},
{
"name": "20051222 XSS\u0026Sql injection attack in PHP-Fusion 6.00.3 Released",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/420109/100/0/threaded"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2005-12-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "SQL injection vulnerability in PHP-Fusion 6.00.200 through 6.00.300 allows remote attackers to execute arbitrary SQL commands via the ratings parameter in multiple scripts, such as ratings_include.php."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-19T14:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "ADV-2005-3063",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2005/3063"
},
{
"name": "22049",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/22049"
},
{
"name": "272",
"tags": [
"third-party-advisory",
"x_refsource_SREASON"
],
"url": "http://securityreason.com/securityalert/272"
},
{
"name": "18190",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/18190/"
},
{
"name": "20051222 XSS\u0026Sql injection attack in PHP-Fusion 6.00.3 Released",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/420109/100/0/threaded"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2005-4517",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "SQL injection vulnerability in PHP-Fusion 6.00.200 through 6.00.300 allows remote attackers to execute arbitrary SQL commands via the ratings parameter in multiple scripts, such as ratings_include.php."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "ADV-2005-3063",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2005/3063"
},
{
"name": "22049",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/22049"
},
{
"name": "272",
"refsource": "SREASON",
"url": "http://securityreason.com/securityalert/272"
},
{
"name": "18190",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/18190/"
},
{
"name": "20051222 XSS\u0026Sql injection attack in PHP-Fusion 6.00.3 Released",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/420109/100/0/threaded"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2005-4517",
"datePublished": "2005-12-28T01:00:00.000Z",
"dateReserved": "2005-12-28T00:00:00.000Z",
"dateUpdated": "2024-08-07T23:46:05.541Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2005-4005 (GCVE-0-2005-4005)
Vulnerability from nvd – Published: 2005-12-05 01:00 – Updated: 2024-08-07 23:31
VLAI
EPSS
VEX
Summary
SQL injection vulnerability in messages.php in PHP-Fusion 6.00.109 allows remote attackers to obtain path information and possibly execute arbitrary SQL commands via the srch_text parameter in a Search and Sort option to messages.php.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
6 references
| URL | Tags |
|---|---|
| http://www.securityfocus.com/bid/15698 | vdb-entryx_refsource_BID |
| http://securityreason.com/securityalert/31 | third-party-advisoryx_refsource_SREASON |
| http://www.osvdb.org/21415 | vdb-entryx_refsource_OSVDB |
| http://www.securityfocus.com/archive/1/418512 | mailing-listx_refsource_BUGTRAQ |
| http://secunia.com/advisories/17871 | third-party-advisoryx_refsource_SECUNIA |
| http://www.vupen.com/english/advisories/2005/2730 | vdb-entryx_refsource_VUPEN |
Date Public
2005-12-03 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T23:31:48.713Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "15698",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/15698"
},
{
"name": "31",
"tags": [
"third-party-advisory",
"x_refsource_SREASON",
"x_transferred"
],
"url": "http://securityreason.com/securityalert/31"
},
{
"name": "21415",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/21415"
},
{
"name": "20051203 PHP-Fusion v6.00.109 SQL Injection and Info. Disclosure",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/418512"
},
{
"name": "17871",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/17871"
},
{
"name": "ADV-2005-2730",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2005/2730"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2005-12-03T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "SQL injection vulnerability in messages.php in PHP-Fusion 6.00.109 allows remote attackers to obtain path information and possibly execute arbitrary SQL commands via the srch_text parameter in a Search and Sort option to messages.php."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2005-12-08T10:00:00.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "15698",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/15698"
},
{
"name": "31",
"tags": [
"third-party-advisory",
"x_refsource_SREASON"
],
"url": "http://securityreason.com/securityalert/31"
},
{
"name": "21415",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/21415"
},
{
"name": "20051203 PHP-Fusion v6.00.109 SQL Injection and Info. Disclosure",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/418512"
},
{
"name": "17871",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/17871"
},
{
"name": "ADV-2005-2730",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2005/2730"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2005-4005",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "SQL injection vulnerability in messages.php in PHP-Fusion 6.00.109 allows remote attackers to obtain path information and possibly execute arbitrary SQL commands via the srch_text parameter in a Search and Sort option to messages.php."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "15698",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/15698"
},
{
"name": "31",
"refsource": "SREASON",
"url": "http://securityreason.com/securityalert/31"
},
{
"name": "21415",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/21415"
},
{
"name": "20051203 PHP-Fusion v6.00.109 SQL Injection and Info. Disclosure",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/418512"
},
{
"name": "17871",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/17871"
},
{
"name": "ADV-2005-2730",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2005/2730"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2005-4005",
"datePublished": "2005-12-05T01:00:00.000Z",
"dateReserved": "2005-12-04T00:00:00.000Z",
"dateUpdated": "2024-08-07T23:31:48.713Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2005-3740 (GCVE-0-2005-3740)
Vulnerability from nvd – Published: 2005-11-22 11:00 – Updated: 2024-08-07 23:24
VLAI
EPSS
VEX
Summary
Multiple SQL injection vulnerabilities in PHP-Fusion 6.00.206 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the forum_id parameter to options.php or (2) lastvisited parameter to viewforum.php.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
8 references
| URL | Tags |
|---|---|
| http://www.osvdb.org/20992 | vdb-entryx_refsource_OSVDB |
| http://seclists.org/lists/bugtraq/2005/Nov/0237.html | mailing-listx_refsource_BUGTRAQ |
| http://myblog.it-security23.net/advisories/adviso… | x_refsource_MISC |
| http://seclists.org/lists/bugtraq/2005/Nov/0232.html | mailing-listx_refsource_BUGTRAQ |
| http://www.securityfocus.com/bid/15502 | vdb-entryx_refsource_BID |
| http://www.osvdb.org/20991 | vdb-entryx_refsource_OSVDB |
| http://www.vupen.com/english/advisories/2005/2504 | vdb-entryx_refsource_VUPEN |
| http://secunia.com/advisories/17664 | third-party-advisoryx_refsource_SECUNIA |
Date Public
2005-11-21 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T23:24:36.279Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20992",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/20992"
},
{
"name": "20051119 Re: PHP-Fusion \u003c= 6.00.206 Multiple Vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://seclists.org/lists/bugtraq/2005/Nov/0237.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://myblog.it-security23.net/advisories/advisory-6.txt"
},
{
"name": "20051118 PHP-Fusion \u003c= 6.00.206 Multiple Vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://seclists.org/lists/bugtraq/2005/Nov/0232.html"
},
{
"name": "15502",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/15502"
},
{
"name": "20991",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/20991"
},
{
"name": "ADV-2005-2504",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2005/2504"
},
{
"name": "17664",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/17664"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2005-11-21T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Multiple SQL injection vulnerabilities in PHP-Fusion 6.00.206 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the forum_id parameter to options.php or (2) lastvisited parameter to viewforum.php."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2006-01-10T10:00:00.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "20992",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/20992"
},
{
"name": "20051119 Re: PHP-Fusion \u003c= 6.00.206 Multiple Vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://seclists.org/lists/bugtraq/2005/Nov/0237.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://myblog.it-security23.net/advisories/advisory-6.txt"
},
{
"name": "20051118 PHP-Fusion \u003c= 6.00.206 Multiple Vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://seclists.org/lists/bugtraq/2005/Nov/0232.html"
},
{
"name": "15502",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/15502"
},
{
"name": "20991",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/20991"
},
{
"name": "ADV-2005-2504",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2005/2504"
},
{
"name": "17664",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/17664"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2005-3740",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple SQL injection vulnerabilities in PHP-Fusion 6.00.206 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the forum_id parameter to options.php or (2) lastvisited parameter to viewforum.php."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20992",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/20992"
},
{
"name": "20051119 Re: PHP-Fusion \u003c= 6.00.206 Multiple Vulnerabilities",
"refsource": "BUGTRAQ",
"url": "http://seclists.org/lists/bugtraq/2005/Nov/0237.html"
},
{
"name": "http://myblog.it-security23.net/advisories/advisory-6.txt",
"refsource": "MISC",
"url": "http://myblog.it-security23.net/advisories/advisory-6.txt"
},
{
"name": "20051118 PHP-Fusion \u003c= 6.00.206 Multiple Vulnerabilities",
"refsource": "BUGTRAQ",
"url": "http://seclists.org/lists/bugtraq/2005/Nov/0232.html"
},
{
"name": "15502",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/15502"
},
{
"name": "20991",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/20991"
},
{
"name": "ADV-2005-2504",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2005/2504"
},
{
"name": "17664",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/17664"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2005-3740",
"datePublished": "2005-11-22T11:00:00.000Z",
"dateReserved": "2005-11-22T00:00:00.000Z",
"dateUpdated": "2024-08-07T23:24:36.279Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2005-3157 (GCVE-0-2005-3157)
Vulnerability from nvd – Published: 2005-10-06 04:00 – Updated: 2024-08-07 23:01
VLAI
EPSS
VEX
Summary
SQL injection vulnerability in messages.php in PHP-Fusion 6.00.109 allows remote attackers to execute arbitrary SQL commands via the msg_send parameter, a different vulnerability than CVE-2005-3158 and CVE-2005-3159.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
4 references
| URL | Tags |
|---|---|
| http://secunia.com/advisories/16994 | third-party-advisoryx_refsource_SECUNIA |
| http://rgod.altervista.org/phpfusion600109.html | x_refsource_MISC |
| http://marc.info/?l=bugtraq&m=112793982604963&w=2 | mailing-listx_refsource_BUGTRAQ |
| http://www.php-fusion.co.uk/news.php?readmore=259 | x_refsource_CONFIRM |
Date Public
2005-09-28 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T23:01:57.985Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "16994",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/16994"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://rgod.altervista.org/phpfusion600109.html"
},
{
"name": "20050928 PHP-Fusion v6.00.109 SQL Injection / admin|users credentials",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://marc.info/?l=bugtraq\u0026m=112793982604963\u0026w=2"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.php-fusion.co.uk/news.php?readmore=259"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2005-09-28T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "SQL injection vulnerability in messages.php in PHP-Fusion 6.00.109 allows remote attackers to execute arbitrary SQL commands via the msg_send parameter, a different vulnerability than CVE-2005-3158 and CVE-2005-3159."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2016-10-17T13:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "16994",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/16994"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://rgod.altervista.org/phpfusion600109.html"
},
{
"name": "20050928 PHP-Fusion v6.00.109 SQL Injection / admin|users credentials",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://marc.info/?l=bugtraq\u0026m=112793982604963\u0026w=2"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.php-fusion.co.uk/news.php?readmore=259"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2005-3157",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "SQL injection vulnerability in messages.php in PHP-Fusion 6.00.109 allows remote attackers to execute arbitrary SQL commands via the msg_send parameter, a different vulnerability than CVE-2005-3158 and CVE-2005-3159."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "16994",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/16994"
},
{
"name": "http://rgod.altervista.org/phpfusion600109.html",
"refsource": "MISC",
"url": "http://rgod.altervista.org/phpfusion600109.html"
},
{
"name": "20050928 PHP-Fusion v6.00.109 SQL Injection / admin|users credentials",
"refsource": "BUGTRAQ",
"url": "http://marc.info/?l=bugtraq\u0026m=112793982604963\u0026w=2"
},
{
"name": "http://www.php-fusion.co.uk/news.php?readmore=259",
"refsource": "CONFIRM",
"url": "http://www.php-fusion.co.uk/news.php?readmore=259"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2005-3157",
"datePublished": "2005-10-06T04:00:00.000Z",
"dateReserved": "2005-10-05T00:00:00.000Z",
"dateUpdated": "2024-08-07T23:01:57.985Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2005-3160 (GCVE-0-2005-3160)
Vulnerability from nvd – Published: 2005-10-06 04:00 – Updated: 2024-08-07 23:01
VLAI
EPSS
VEX
Summary
Multiple SQL injection vulnerabilities in photogallery.php in PHP-Fusion allow remote attackers to execute arbitrary SQL commands via the (1) album and (2) photo parameters.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
2 references
| URL | Tags |
|---|---|
| http://secunia.com/advisories/17048 | third-party-advisoryx_refsource_SECUNIA |
| http://www.osvdb.org/19841 | vdb-entryx_refsource_OSVDB |
Date Public
2005-10-04 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T23:01:58.020Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "17048",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/17048"
},
{
"name": "19841",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/19841"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2005-10-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Multiple SQL injection vulnerabilities in photogallery.php in PHP-Fusion allow remote attackers to execute arbitrary SQL commands via the (1) album and (2) photo parameters."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2006-04-04T09:00:00.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "17048",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/17048"
},
{
"name": "19841",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/19841"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2005-3160",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple SQL injection vulnerabilities in photogallery.php in PHP-Fusion allow remote attackers to execute arbitrary SQL commands via the (1) album and (2) photo parameters."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "17048",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/17048"
},
{
"name": "19841",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/19841"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2005-3160",
"datePublished": "2005-10-06T04:00:00.000Z",
"dateReserved": "2005-10-06T00:00:00.000Z",
"dateUpdated": "2024-08-07T23:01:58.020Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2005-3158 (GCVE-0-2005-3158)
Vulnerability from nvd – Published: 2005-10-06 04:00 – Updated: 2024-08-07 23:01
VLAI
EPSS
VEX
Summary
SQL injection vulnerability in messages.php in PHP-Fusion 6.00.106 and 6.00.107 allows remote attackers to execute arbitrary SQL commands via the (1) pm_email_notify and (2) pm_save_sent parameters, a different vulnerability than CVE-2005-3157 and CVE-2005-3159.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
2 references
| URL | Tags |
|---|---|
| http://marc.info/?l=bugtraq&m=112801702000944&w=2 | mailing-listx_refsource_BUGTRAQ |
| http://www.gnucitizen.org/writings/php-fusion-mes… | x_refsource_MISC |
Date Public
2005-09-29 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T23:01:58.238Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20050929 Re: PHP-Fusion v6.00.109 SQL Injection / admin|users credentials",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://marc.info/?l=bugtraq\u0026m=112801702000944\u0026w=2"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.gnucitizen.org/writings/php-fusion-messages.php-sql-injection-vulnerability.xhtml"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2005-09-29T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "SQL injection vulnerability in messages.php in PHP-Fusion 6.00.106 and 6.00.107 allows remote attackers to execute arbitrary SQL commands via the (1) pm_email_notify and (2) pm_save_sent parameters, a different vulnerability than CVE-2005-3157 and CVE-2005-3159."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2016-10-17T13:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "20050929 Re: PHP-Fusion v6.00.109 SQL Injection / admin|users credentials",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://marc.info/?l=bugtraq\u0026m=112801702000944\u0026w=2"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.gnucitizen.org/writings/php-fusion-messages.php-sql-injection-vulnerability.xhtml"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2005-3158",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "SQL injection vulnerability in messages.php in PHP-Fusion 6.00.106 and 6.00.107 allows remote attackers to execute arbitrary SQL commands via the (1) pm_email_notify and (2) pm_save_sent parameters, a different vulnerability than CVE-2005-3157 and CVE-2005-3159."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20050929 Re: PHP-Fusion v6.00.109 SQL Injection / admin|users credentials",
"refsource": "BUGTRAQ",
"url": "http://marc.info/?l=bugtraq\u0026m=112801702000944\u0026w=2"
},
{
"name": "http://www.gnucitizen.org/writings/php-fusion-messages.php-sql-injection-vulnerability.xhtml",
"refsource": "MISC",
"url": "http://www.gnucitizen.org/writings/php-fusion-messages.php-sql-injection-vulnerability.xhtml"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2005-3158",
"datePublished": "2005-10-06T04:00:00.000Z",
"dateReserved": "2005-10-05T00:00:00.000Z",
"dateUpdated": "2024-08-07T23:01:58.238Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2005-3161 (GCVE-0-2005-3161)
Vulnerability from nvd – Published: 2005-10-06 04:00 – Updated: 2024-08-07 23:01
VLAI
EPSS
VEX
Summary
Multiple SQL injection vulnerabilities in PHP-Fusion before 6.00.110 allow remote attackers to execute arbitrary SQL commands via (1) the activate parameter in register.php and (2) the cat_id parameter in faq.php.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
8 references
| URL | Tags |
|---|---|
| http://www.osvdb.org/19867 | vdb-entryx_refsource_OSVDB |
| https://exchange.xforce.ibmcloud.com/vulnerabilit… | vdb-entryx_refsource_XF |
| http://www.osvdb.org/19866 | vdb-entryx_refsource_OSVDB |
| http://www.securityfocus.com/bid/15018 | vdb-entryx_refsource_BID |
| http://secunia.com/secunia_research/2005-52/advisory/ | x_refsource_MISC |
| http://www.php-fusion.co.uk/news.php?readmore=261 | x_refsource_CONFIRM |
| http://securityreason.com/securityalert/54 | third-party-advisoryx_refsource_SREASON |
| http://secunia.com/advisories/17055 | third-party-advisoryx_refsource_SECUNIA |
Date Public
2005-10-04 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T23:01:58.128Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "19867",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/19867"
},
{
"name": "phpfusion-faq-register-sql-injection(22532)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/22532"
},
{
"name": "19866",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/19866"
},
{
"name": "15018",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/15018"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://secunia.com/secunia_research/2005-52/advisory/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.php-fusion.co.uk/news.php?readmore=261"
},
{
"name": "54",
"tags": [
"third-party-advisory",
"x_refsource_SREASON",
"x_transferred"
],
"url": "http://securityreason.com/securityalert/54"
},
{
"name": "17055",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/17055"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2005-10-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Multiple SQL injection vulnerabilities in PHP-Fusion before 6.00.110 allow remote attackers to execute arbitrary SQL commands via (1) the activate parameter in register.php and (2) the cat_id parameter in faq.php."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-10T14:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "19867",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/19867"
},
{
"name": "phpfusion-faq-register-sql-injection(22532)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/22532"
},
{
"name": "19866",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/19866"
},
{
"name": "15018",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/15018"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://secunia.com/secunia_research/2005-52/advisory/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.php-fusion.co.uk/news.php?readmore=261"
},
{
"name": "54",
"tags": [
"third-party-advisory",
"x_refsource_SREASON"
],
"url": "http://securityreason.com/securityalert/54"
},
{
"name": "17055",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/17055"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2005-3161",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple SQL injection vulnerabilities in PHP-Fusion before 6.00.110 allow remote attackers to execute arbitrary SQL commands via (1) the activate parameter in register.php and (2) the cat_id parameter in faq.php."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "19867",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/19867"
},
{
"name": "phpfusion-faq-register-sql-injection(22532)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/22532"
},
{
"name": "19866",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/19866"
},
{
"name": "15018",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/15018"
},
{
"name": "http://secunia.com/secunia_research/2005-52/advisory/",
"refsource": "MISC",
"url": "http://secunia.com/secunia_research/2005-52/advisory/"
},
{
"name": "http://www.php-fusion.co.uk/news.php?readmore=261",
"refsource": "CONFIRM",
"url": "http://www.php-fusion.co.uk/news.php?readmore=261"
},
{
"name": "54",
"refsource": "SREASON",
"url": "http://securityreason.com/securityalert/54"
},
{
"name": "17055",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/17055"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2005-3161",
"datePublished": "2005-10-06T04:00:00.000Z",
"dateReserved": "2005-10-06T00:00:00.000Z",
"dateUpdated": "2024-08-07T23:01:58.128Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2006-4673 (GCVE-0-2006-4673)
Vulnerability from cvelistv5 – Published: 2006-09-11 16:00 – Updated: 2024-08-07 19:23
VLAI
EPSS
VEX
Summary
Global variable overwrite vulnerability in maincore.php in PHP-Fusion 6.01.4 and earlier uses the extract function on the superglobals, which allows remote attackers to conduct SQL injection attacks via the _SERVER[REMOTE_ADDR] parameter to news.php.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
7 references
| URL | Tags |
|---|---|
| http://www.securityfocus.com/bid/19908 | vdb-entryx_refsource_BID |
| http://marc.info/?l=bugtraq&m=115765187519458&w=2 | mailing-listx_refsource_BUGTRAQ |
| http://www.vupen.com/english/advisories/2006/3523 | vdb-entryx_refsource_VUPEN |
| http://www.php-fusion.co.uk/news.php?readmore=353 | x_refsource_CONFIRM |
| http://retrogod.altervista.org/phpfusion_6-01-4_x… | x_refsource_MISC |
| https://exchange.xforce.ibmcloud.com/vulnerabilit… | vdb-entryx_refsource_XF |
| http://secunia.com/advisories/21830 | third-party-advisoryx_refsource_SECUNIA |
Date Public
2006-09-07 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T19:23:40.437Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "19908",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/19908"
},
{
"name": "20060907 PHPFusion \u003c= 6.01.4 extract()/_SERVER[REMOTE_ADDR] sql injection",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://marc.info/?l=bugtraq\u0026m=115765187519458\u0026w=2"
},
{
"name": "ADV-2006-3523",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2006/3523"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.php-fusion.co.uk/news.php?readmore=353"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://retrogod.altervista.org/phpfusion_6-01-4_xpl.html"
},
{
"name": "phpfusion-manicore-sql-injection(28818)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/28818"
},
{
"name": "21830",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/21830"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2006-09-07T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Global variable overwrite vulnerability in maincore.php in PHP-Fusion 6.01.4 and earlier uses the extract function on the superglobals, which allows remote attackers to conduct SQL injection attacks via the _SERVER[REMOTE_ADDR] parameter to news.php."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-19T15:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "19908",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/19908"
},
{
"name": "20060907 PHPFusion \u003c= 6.01.4 extract()/_SERVER[REMOTE_ADDR] sql injection",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://marc.info/?l=bugtraq\u0026m=115765187519458\u0026w=2"
},
{
"name": "ADV-2006-3523",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2006/3523"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.php-fusion.co.uk/news.php?readmore=353"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://retrogod.altervista.org/phpfusion_6-01-4_xpl.html"
},
{
"name": "phpfusion-manicore-sql-injection(28818)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/28818"
},
{
"name": "21830",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/21830"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2006-4673",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Global variable overwrite vulnerability in maincore.php in PHP-Fusion 6.01.4 and earlier uses the extract function on the superglobals, which allows remote attackers to conduct SQL injection attacks via the _SERVER[REMOTE_ADDR] parameter to news.php."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "19908",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/19908"
},
{
"name": "20060907 PHPFusion \u003c= 6.01.4 extract()/_SERVER[REMOTE_ADDR] sql injection",
"refsource": "BUGTRAQ",
"url": "http://marc.info/?l=bugtraq\u0026m=115765187519458\u0026w=2"
},
{
"name": "ADV-2006-3523",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2006/3523"
},
{
"name": "http://www.php-fusion.co.uk/news.php?readmore=353",
"refsource": "CONFIRM",
"url": "http://www.php-fusion.co.uk/news.php?readmore=353"
},
{
"name": "http://retrogod.altervista.org/phpfusion_6-01-4_xpl.html",
"refsource": "MISC",
"url": "http://retrogod.altervista.org/phpfusion_6-01-4_xpl.html"
},
{
"name": "phpfusion-manicore-sql-injection(28818)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/28818"
},
{
"name": "21830",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/21830"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2006-4673",
"datePublished": "2006-09-11T16:00:00.000Z",
"dateReserved": "2006-09-11T00:00:00.000Z",
"dateUpdated": "2024-08-07T19:23:40.437Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2006-3555 (GCVE-0-2006-3555)
Vulnerability from cvelistv5 – Published: 2006-07-13 00:00 – Updated: 2024-08-07 18:30
VLAI
EPSS
VEX
Summary
Multiple cross-site scripting (XSS) vulnerabilities in submit.php in PHP-Fusion before 6.01.3 allow remote attackers to inject arbitrary web script or HTML by using edit_profile.php to upload a (1) avatar or (2) forum image attachment that has a .gif or .jpg extension, and begins with a GIF header followed by JavaScript code, which is executed by Internet Explorer.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
7 references
| URL | Tags |
|---|---|
| http://www.securityfocus.com/archive/1/438938/100… | mailing-listx_refsource_BUGTRAQ |
| http://www.securityfocus.com/bid/18787 | vdb-entryx_refsource_BID |
| http://www.vupen.com/english/advisories/2006/2655 | vdb-entryx_refsource_VUPEN |
| http://securityreason.com/securityalert/1224 | third-party-advisoryx_refsource_SREASON |
| http://secunia.com/advisories/20904 | third-party-advisoryx_refsource_SECUNIA |
| https://exchange.xforce.ibmcloud.com/vulnerabilit… | vdb-entryx_refsource_XF |
| http://php-fusion.co.uk/news.php | x_refsource_CONFIRM |
Date Public
2006-06-28 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T18:30:34.447Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20060701 Php-Fusion (Xss) With Avatar Upload",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/438938/100/0/threaded"
},
{
"name": "18787",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/18787"
},
{
"name": "ADV-2006-2655",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2006/2655"
},
{
"name": "1224",
"tags": [
"third-party-advisory",
"x_refsource_SREASON",
"x_transferred"
],
"url": "http://securityreason.com/securityalert/1224"
},
{
"name": "20904",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/20904"
},
{
"name": "phpfusion-avatar-xss(27537)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/27537"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://php-fusion.co.uk/news.php"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2006-06-28T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in submit.php in PHP-Fusion before 6.01.3 allow remote attackers to inject arbitrary web script or HTML by using edit_profile.php to upload a (1) avatar or (2) forum image attachment that has a .gif or .jpg extension, and begins with a GIF header followed by JavaScript code, which is executed by Internet Explorer."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-18T14:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "20060701 Php-Fusion (Xss) With Avatar Upload",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/438938/100/0/threaded"
},
{
"name": "18787",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/18787"
},
{
"name": "ADV-2006-2655",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2006/2655"
},
{
"name": "1224",
"tags": [
"third-party-advisory",
"x_refsource_SREASON"
],
"url": "http://securityreason.com/securityalert/1224"
},
{
"name": "20904",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/20904"
},
{
"name": "phpfusion-avatar-xss(27537)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/27537"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://php-fusion.co.uk/news.php"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2006-3555",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in submit.php in PHP-Fusion before 6.01.3 allow remote attackers to inject arbitrary web script or HTML by using edit_profile.php to upload a (1) avatar or (2) forum image attachment that has a .gif or .jpg extension, and begins with a GIF header followed by JavaScript code, which is executed by Internet Explorer."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20060701 Php-Fusion (Xss) With Avatar Upload",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/438938/100/0/threaded"
},
{
"name": "18787",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/18787"
},
{
"name": "ADV-2006-2655",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2006/2655"
},
{
"name": "1224",
"refsource": "SREASON",
"url": "http://securityreason.com/securityalert/1224"
},
{
"name": "20904",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/20904"
},
{
"name": "phpfusion-avatar-xss(27537)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/27537"
},
{
"name": "http://php-fusion.co.uk/news.php",
"refsource": "CONFIRM",
"url": "http://php-fusion.co.uk/news.php"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2006-3555",
"datePublished": "2006-07-13T00:00:00.000Z",
"dateReserved": "2006-07-12T00:00:00.000Z",
"dateUpdated": "2024-08-07T18:30:34.447Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2006-2459 (GCVE-0-2006-2459)
Vulnerability from cvelistv5 – Published: 2006-05-19 10:00 – Updated: 2024-08-07 17:51
VLAI
EPSS
VEX
Summary
SQL injection vulnerability in messages.php in PHP-Fusion 6.00.307 and earlier allows remote authenticated users to execute arbitrary SQL commands via the srch_where parameter.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://exchange.xforce.ibmcloud.com/vulnerabilit… | vdb-entryx_refsource_XF |
| http://www.securityfocus.com/bid/18009 | vdb-entryx_refsource_BID |
| http://securityreason.com/securityalert/922 | third-party-advisoryx_refsource_SREASON |
| http://www.securityfocus.com/archive/1/434162/100… | mailing-listx_refsource_BUGTRAQ |
| http://www.osvdb.org/25542 | vdb-entryx_refsource_OSVDB |
| http://secunia.com/advisories/20129 | third-party-advisoryx_refsource_SECUNIA |
| http://retrogod.altervista.org/phpfusion_600306_s… | x_refsource_MISC |
| http://securitytracker.com/id?1016111 | vdb-entryx_refsource_SECTRACK |
| http://www.vupen.com/english/advisories/2006/1839 | vdb-entryx_refsource_VUPEN |
Date Public
2006-05-16 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T17:51:04.896Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "phpfusion-srchwhere-sql-injection(26491)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26491"
},
{
"name": "18009",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/18009"
},
{
"name": "922",
"tags": [
"third-party-advisory",
"x_refsource_SREASON",
"x_transferred"
],
"url": "http://securityreason.com/securityalert/922"
},
{
"name": "20060516 PHP-Fusion \u003c= 6.00.306 \"srch_where\" SQL injection / admin credentials disclosure",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/434162/100/0/threaded"
},
{
"name": "25542",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/25542"
},
{
"name": "20129",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/20129"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://retrogod.altervista.org/phpfusion_600306_sql.html"
},
{
"name": "1016111",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1016111"
},
{
"name": "ADV-2006-1839",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2006/1839"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2006-05-16T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "SQL injection vulnerability in messages.php in PHP-Fusion 6.00.307 and earlier allows remote authenticated users to execute arbitrary SQL commands via the srch_where parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-18T14:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "phpfusion-srchwhere-sql-injection(26491)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26491"
},
{
"name": "18009",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/18009"
},
{
"name": "922",
"tags": [
"third-party-advisory",
"x_refsource_SREASON"
],
"url": "http://securityreason.com/securityalert/922"
},
{
"name": "20060516 PHP-Fusion \u003c= 6.00.306 \"srch_where\" SQL injection / admin credentials disclosure",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/434162/100/0/threaded"
},
{
"name": "25542",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/25542"
},
{
"name": "20129",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/20129"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://retrogod.altervista.org/phpfusion_600306_sql.html"
},
{
"name": "1016111",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1016111"
},
{
"name": "ADV-2006-1839",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2006/1839"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2006-2459",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "SQL injection vulnerability in messages.php in PHP-Fusion 6.00.307 and earlier allows remote authenticated users to execute arbitrary SQL commands via the srch_where parameter."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "phpfusion-srchwhere-sql-injection(26491)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26491"
},
{
"name": "18009",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/18009"
},
{
"name": "922",
"refsource": "SREASON",
"url": "http://securityreason.com/securityalert/922"
},
{
"name": "20060516 PHP-Fusion \u003c= 6.00.306 \"srch_where\" SQL injection / admin credentials disclosure",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/434162/100/0/threaded"
},
{
"name": "25542",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/25542"
},
{
"name": "20129",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/20129"
},
{
"name": "http://retrogod.altervista.org/phpfusion_600306_sql.html",
"refsource": "MISC",
"url": "http://retrogod.altervista.org/phpfusion_600306_sql.html"
},
{
"name": "1016111",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1016111"
},
{
"name": "ADV-2006-1839",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2006/1839"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2006-2459",
"datePublished": "2006-05-19T10:00:00.000Z",
"dateReserved": "2006-05-19T00:00:00.000Z",
"dateUpdated": "2024-08-07T17:51:04.896Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2006-2330 (GCVE-0-2006-2330)
Vulnerability from cvelistv5 – Published: 2006-05-12 00:00 – Updated: 2024-08-07 17:43
VLAI
EPSS
VEX
Summary
PHP-Fusion 6.00.306 and earlier, running under Apache HTTP Server 1.3.27 and PHP 4.3.3, allows remote authenticated users to upload files of arbitrary types using a filename that contains two or more extensions that ends in an assumed-valid extension such as .gif, which bypasses the validation, as demonstrated by uploading then executing an avatar file that ends in ".php.gif" and contains PHP code in EXIF metadata.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
8 references
| URL | Tags |
|---|---|
| http://securityreason.com/securityalert/873 | third-party-advisoryx_refsource_SREASON |
| http://www.php-fusion.co.uk/news.php | x_refsource_CONFIRM |
| https://exchange.xforce.ibmcloud.com/vulnerabilit… | vdb-entryx_refsource_XF |
| http://www.osvdb.org/25537 | vdb-entryx_refsource_OSVDB |
| http://www.securityfocus.com/archive/1/433277/100… | mailing-listx_refsource_BUGTRAQ |
| http://secunia.com/advisories/19992 | third-party-advisoryx_refsource_SECUNIA |
| http://www.securityfocus.com/bid/17898 | vdb-entryx_refsource_BID |
| http://www.vupen.com/english/advisories/2006/1735 | vdb-entryx_refsource_VUPEN |
Date Public
2006-05-08 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T17:43:29.179Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "873",
"tags": [
"third-party-advisory",
"x_refsource_SREASON",
"x_transferred"
],
"url": "http://securityreason.com/securityalert/873"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.php-fusion.co.uk/news.php"
},
{
"name": "phpfusion-avatar-extensions-code-execution(26388)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26388"
},
{
"name": "25537",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/25537"
},
{
"name": "20060508 PHPFusion \u003c= v6.00.306 avatar mod_mime arbitrary file upload \u0026 local inclusion vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/433277/100/0/threaded"
},
{
"name": "19992",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/19992"
},
{
"name": "17898",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/17898"
},
{
"name": "ADV-2006-1735",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2006/1735"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2006-05-08T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "PHP-Fusion 6.00.306 and earlier, running under Apache HTTP Server 1.3.27 and PHP 4.3.3, allows remote authenticated users to upload files of arbitrary types using a filename that contains two or more extensions that ends in an assumed-valid extension such as .gif, which bypasses the validation, as demonstrated by uploading then executing an avatar file that ends in \".php.gif\" and contains PHP code in EXIF metadata."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-18T14:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "873",
"tags": [
"third-party-advisory",
"x_refsource_SREASON"
],
"url": "http://securityreason.com/securityalert/873"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.php-fusion.co.uk/news.php"
},
{
"name": "phpfusion-avatar-extensions-code-execution(26388)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26388"
},
{
"name": "25537",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/25537"
},
{
"name": "20060508 PHPFusion \u003c= v6.00.306 avatar mod_mime arbitrary file upload \u0026 local inclusion vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/433277/100/0/threaded"
},
{
"name": "19992",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/19992"
},
{
"name": "17898",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/17898"
},
{
"name": "ADV-2006-1735",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2006/1735"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2006-2330",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "PHP-Fusion 6.00.306 and earlier, running under Apache HTTP Server 1.3.27 and PHP 4.3.3, allows remote authenticated users to upload files of arbitrary types using a filename that contains two or more extensions that ends in an assumed-valid extension such as .gif, which bypasses the validation, as demonstrated by uploading then executing an avatar file that ends in \".php.gif\" and contains PHP code in EXIF metadata."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "873",
"refsource": "SREASON",
"url": "http://securityreason.com/securityalert/873"
},
{
"name": "http://www.php-fusion.co.uk/news.php",
"refsource": "CONFIRM",
"url": "http://www.php-fusion.co.uk/news.php"
},
{
"name": "phpfusion-avatar-extensions-code-execution(26388)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26388"
},
{
"name": "25537",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/25537"
},
{
"name": "20060508 PHPFusion \u003c= v6.00.306 avatar mod_mime arbitrary file upload \u0026 local inclusion vulnerabilities",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/433277/100/0/threaded"
},
{
"name": "19992",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/19992"
},
{
"name": "17898",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/17898"
},
{
"name": "ADV-2006-1735",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2006/1735"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2006-2330",
"datePublished": "2006-05-12T00:00:00.000Z",
"dateReserved": "2006-05-11T00:00:00.000Z",
"dateUpdated": "2024-08-07T17:43:29.179Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2006-2331 (GCVE-0-2006-2331)
Vulnerability from cvelistv5 – Published: 2006-05-12 00:00 – Updated: 2024-08-07 17:43
VLAI
EPSS
VEX
Summary
Multiple directory traversal vulnerabilities in PHP-Fusion 6.00.306 allow remote attackers to include and execute arbitrary local files via (1) a .. (dot dot) in the settings[locale] parameter in infusions/last_seen_users_panel/last_seen_users_panel.php, and (2) a .. (dot dot) in the localeset parameter in setup.php. NOTE: the vendor states that this issue might exist due to problems in third party local files.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
11 references
| URL | Tags |
|---|---|
| http://securityreason.com/securityalert/873 | third-party-advisoryx_refsource_SREASON |
| http://www.php-fusion.co.uk/news.php | x_refsource_CONFIRM |
| https://exchange.xforce.ibmcloud.com/vulnerabilit… | vdb-entryx_refsource_XF |
| http://www.osvdb.org/25539 | vdb-entryx_refsource_OSVDB |
| http://www.securityfocus.com/archive/1/433277/100… | mailing-listx_refsource_BUGTRAQ |
| http://securityreason.com/securityalert/194 | third-party-advisoryx_refsource_SREASON |
| http://secunia.com/advisories/19992 | third-party-advisoryx_refsource_SECUNIA |
| http://www.securityfocus.com/bid/17898 | vdb-entryx_refsource_BID |
| http://www.osvdb.org/25538 | vdb-entryx_refsource_OSVDB |
| http://www.vupen.com/english/advisories/2006/1735 | vdb-entryx_refsource_VUPEN |
| http://www.php-fusion.co.uk/news.php?readmore=321 | x_refsource_CONFIRM |
Date Public
2006-05-08 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T17:43:29.285Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "873",
"tags": [
"third-party-advisory",
"x_refsource_SREASON",
"x_transferred"
],
"url": "http://securityreason.com/securityalert/873"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.php-fusion.co.uk/news.php"
},
{
"name": "phpfusion-lastseenuserspanel-file-include(26389)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26389"
},
{
"name": "25539",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/25539"
},
{
"name": "20060508 PHPFusion \u003c= v6.00.306 avatar mod_mime arbitrary file upload \u0026 local inclusion vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/433277/100/0/threaded"
},
{
"name": "194",
"tags": [
"third-party-advisory",
"x_refsource_SREASON",
"x_transferred"
],
"url": "http://securityreason.com/securityalert/194"
},
{
"name": "19992",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/19992"
},
{
"name": "17898",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/17898"
},
{
"name": "25538",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/25538"
},
{
"name": "ADV-2006-1735",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2006/1735"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.php-fusion.co.uk/news.php?readmore=321"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2006-05-08T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Multiple directory traversal vulnerabilities in PHP-Fusion 6.00.306 allow remote attackers to include and execute arbitrary local files via (1) a .. (dot dot) in the settings[locale] parameter in infusions/last_seen_users_panel/last_seen_users_panel.php, and (2) a .. (dot dot) in the localeset parameter in setup.php. NOTE: the vendor states that this issue might exist due to problems in third party local files."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-18T14:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "873",
"tags": [
"third-party-advisory",
"x_refsource_SREASON"
],
"url": "http://securityreason.com/securityalert/873"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.php-fusion.co.uk/news.php"
},
{
"name": "phpfusion-lastseenuserspanel-file-include(26389)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26389"
},
{
"name": "25539",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/25539"
},
{
"name": "20060508 PHPFusion \u003c= v6.00.306 avatar mod_mime arbitrary file upload \u0026 local inclusion vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/433277/100/0/threaded"
},
{
"name": "194",
"tags": [
"third-party-advisory",
"x_refsource_SREASON"
],
"url": "http://securityreason.com/securityalert/194"
},
{
"name": "19992",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/19992"
},
{
"name": "17898",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/17898"
},
{
"name": "25538",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/25538"
},
{
"name": "ADV-2006-1735",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2006/1735"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.php-fusion.co.uk/news.php?readmore=321"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2006-2331",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple directory traversal vulnerabilities in PHP-Fusion 6.00.306 allow remote attackers to include and execute arbitrary local files via (1) a .. (dot dot) in the settings[locale] parameter in infusions/last_seen_users_panel/last_seen_users_panel.php, and (2) a .. (dot dot) in the localeset parameter in setup.php. NOTE: the vendor states that this issue might exist due to problems in third party local files."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "873",
"refsource": "SREASON",
"url": "http://securityreason.com/securityalert/873"
},
{
"name": "http://www.php-fusion.co.uk/news.php",
"refsource": "CONFIRM",
"url": "http://www.php-fusion.co.uk/news.php"
},
{
"name": "phpfusion-lastseenuserspanel-file-include(26389)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26389"
},
{
"name": "25539",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/25539"
},
{
"name": "20060508 PHPFusion \u003c= v6.00.306 avatar mod_mime arbitrary file upload \u0026 local inclusion vulnerabilities",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/433277/100/0/threaded"
},
{
"name": "194",
"refsource": "SREASON",
"url": "http://securityreason.com/securityalert/194"
},
{
"name": "19992",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/19992"
},
{
"name": "17898",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/17898"
},
{
"name": "25538",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/25538"
},
{
"name": "ADV-2006-1735",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2006/1735"
},
{
"name": "http://www.php-fusion.co.uk/news.php?readmore=321",
"refsource": "CONFIRM",
"url": "http://www.php-fusion.co.uk/news.php?readmore=321"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2006-2331",
"datePublished": "2006-05-12T00:00:00.000Z",
"dateReserved": "2006-05-11T00:00:00.000Z",
"dateUpdated": "2024-08-07T17:43:29.285Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2006-0593 (GCVE-0-2006-0593)
Vulnerability from cvelistv5 – Published: 2006-02-08 01:00 – Updated: 2024-08-07 16:41
VLAI
EPSS
VEX
Summary
Cross-site scripting (XSS) vulnerability in PHP-Fusion before 6.00.304 allows remote attackers to inject arbitrary web script or HTML via the (1) shout_name field in shoutbox_panel.php and the (2) comments field in comments_include.php.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://exchange.xforce.ibmcloud.com/vulnerabilit… | vdb-entryx_refsource_XF |
| http://www.php-fusion.co.uk/news.php?readmore=307 | x_refsource_CONFIRM |
| http://www.vupen.com/english/advisories/2006/0463 | vdb-entryx_refsource_VUPEN |
| http://www.securityfocus.com/bid/16548 | vdb-entryx_refsource_BID |
| http://www.php-fusion.co.uk/downloads.php?cat_id=3 | x_refsource_CONFIRM |
| http://secunia.com/advisories/18949 | third-party-advisoryx_refsource_SECUNIA |
| http://www.osvdb.org/22981 | vdb-entryx_refsource_OSVDB |
| http://www.osvdb.org/22980 | vdb-entryx_refsource_OSVDB |
Date Public
2006-02-05 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T16:41:28.992Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "phpfusion-multiple-xss(24548)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24548"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.php-fusion.co.uk/news.php?readmore=307"
},
{
"name": "ADV-2006-0463",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2006/0463"
},
{
"name": "16548",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/16548"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.php-fusion.co.uk/downloads.php?cat_id=3"
},
{
"name": "18949",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/18949"
},
{
"name": "22981",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/22981"
},
{
"name": "22980",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/22980"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2006-02-05T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in PHP-Fusion before 6.00.304 allows remote attackers to inject arbitrary web script or HTML via the (1) shout_name field in shoutbox_panel.php and the (2) comments field in comments_include.php."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-19T15:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "phpfusion-multiple-xss(24548)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24548"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.php-fusion.co.uk/news.php?readmore=307"
},
{
"name": "ADV-2006-0463",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2006/0463"
},
{
"name": "16548",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/16548"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.php-fusion.co.uk/downloads.php?cat_id=3"
},
{
"name": "18949",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/18949"
},
{
"name": "22981",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/22981"
},
{
"name": "22980",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/22980"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2006-0593",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in PHP-Fusion before 6.00.304 allows remote attackers to inject arbitrary web script or HTML via the (1) shout_name field in shoutbox_panel.php and the (2) comments field in comments_include.php."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "phpfusion-multiple-xss(24548)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24548"
},
{
"name": "http://www.php-fusion.co.uk/news.php?readmore=307",
"refsource": "CONFIRM",
"url": "http://www.php-fusion.co.uk/news.php?readmore=307"
},
{
"name": "ADV-2006-0463",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2006/0463"
},
{
"name": "16548",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/16548"
},
{
"name": "http://www.php-fusion.co.uk/downloads.php?cat_id=3",
"refsource": "CONFIRM",
"url": "http://www.php-fusion.co.uk/downloads.php?cat_id=3"
},
{
"name": "18949",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/18949"
},
{
"name": "22981",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/22981"
},
{
"name": "22980",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/22980"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2006-0593",
"datePublished": "2006-02-08T01:00:00.000Z",
"dateReserved": "2006-02-08T00:00:00.000Z",
"dateUpdated": "2024-08-07T16:41:28.992Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2005-4655 (GCVE-0-2005-4655)
Vulnerability from cvelistv5 – Published: 2006-01-16 21:00 – Updated: 2024-08-07 23:53
VLAI
EPSS
VEX
Summary
Cross-site scripting (XSS) vulnerability in submit.php in PHP-Fusion 6.0.204 allows remote attackers to inject arbitrary web script or HTML via nested tags in the news_body parameter, as demonstrated by elements such as "<me<meta>ta" and "<sc<script>ript>".
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
4 references
| URL | Tags |
|---|---|
| http://www.vupen.com/english/advisories/2005/2192 | vdb-entryx_refsource_VUPEN |
| http://securityreason.com/securityalert/106 | third-party-advisoryx_refsource_SREASON |
| http://secunia.com/advisories/17312 | third-party-advisoryx_refsource_SECUNIA |
| http://archives.neohapsis.com/archives/bugtraq/20… | mailing-listx_refsource_BUGTRAQ |
Date Public
2005-10-24 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T23:53:28.503Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "ADV-2005-2192",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2005/2192"
},
{
"name": "106",
"tags": [
"third-party-advisory",
"x_refsource_SREASON",
"x_transferred"
],
"url": "http://securityreason.com/securityalert/106"
},
{
"name": "17312",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/17312"
},
{
"name": "20051024 Possible Bug in PHP-Fusion 6.0.204",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2005-10/0272.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2005-10-24T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in submit.php in PHP-Fusion 6.0.204 allows remote attackers to inject arbitrary web script or HTML via nested tags in the news_body parameter, as demonstrated by elements such as \"\u003cme\u003cmeta\u003eta\" and \"\u003csc\u003cscript\u003eript\u003e\"."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2007-08-22T09:00:00.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "ADV-2005-2192",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2005/2192"
},
{
"name": "106",
"tags": [
"third-party-advisory",
"x_refsource_SREASON"
],
"url": "http://securityreason.com/securityalert/106"
},
{
"name": "17312",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/17312"
},
{
"name": "20051024 Possible Bug in PHP-Fusion 6.0.204",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2005-10/0272.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2005-4655",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in submit.php in PHP-Fusion 6.0.204 allows remote attackers to inject arbitrary web script or HTML via nested tags in the news_body parameter, as demonstrated by elements such as \"\u003cme\u003cmeta\u003eta\" and \"\u003csc\u003cscript\u003eript\u003e\"."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "ADV-2005-2192",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2005/2192"
},
{
"name": "106",
"refsource": "SREASON",
"url": "http://securityreason.com/securityalert/106"
},
{
"name": "17312",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/17312"
},
{
"name": "20051024 Possible Bug in PHP-Fusion 6.0.204",
"refsource": "BUGTRAQ",
"url": "http://archives.neohapsis.com/archives/bugtraq/2005-10/0272.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2005-4655",
"datePublished": "2006-01-16T21:00:00.000Z",
"dateReserved": "2006-01-16T00:00:00.000Z",
"dateUpdated": "2024-08-07T23:53:28.503Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2005-4516 (GCVE-0-2005-4516)
Vulnerability from cvelistv5 – Published: 2005-12-28 01:00 – Updated: 2024-08-07 23:46
VLAI
EPSS
VEX
Summary
Multiple cross-site scripting (XSS) vulnerabilities in PHP-Fusion 6.00.200 through 6.00.300 allow remote attackers to inject arbitrary web script or HTML via (1) the sortby parameter in members.php and (2) IMG tags.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
7 references
| URL | Tags |
|---|---|
| http://www.vupen.com/english/advisories/2005/3063 | vdb-entryx_refsource_VUPEN |
| http://www.osvdb.org/22050 | vdb-entryx_refsource_OSVDB |
| http://www.osvdb.org/22048 | vdb-entryx_refsource_OSVDB |
| http://securityreason.com/securityalert/272 | third-party-advisoryx_refsource_SREASON |
| http://www.securityfocus.com/bid/15931 | vdb-entryx_refsource_BID |
| http://secunia.com/advisories/18190/ | third-party-advisoryx_refsource_SECUNIA |
| http://www.securityfocus.com/archive/1/420109/100… | mailing-listx_refsource_BUGTRAQ |
Date Public
2005-12-22 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T23:46:05.512Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "ADV-2005-3063",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2005/3063"
},
{
"name": "22050",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/22050"
},
{
"name": "22048",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/22048"
},
{
"name": "272",
"tags": [
"third-party-advisory",
"x_refsource_SREASON",
"x_transferred"
],
"url": "http://securityreason.com/securityalert/272"
},
{
"name": "15931",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/15931"
},
{
"name": "18190",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/18190/"
},
{
"name": "20051222 XSS\u0026Sql injection attack in PHP-Fusion 6.00.3 Released",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/420109/100/0/threaded"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2005-12-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in PHP-Fusion 6.00.200 through 6.00.300 allow remote attackers to inject arbitrary web script or HTML via (1) the sortby parameter in members.php and (2) IMG tags."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-19T14:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "ADV-2005-3063",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2005/3063"
},
{
"name": "22050",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/22050"
},
{
"name": "22048",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/22048"
},
{
"name": "272",
"tags": [
"third-party-advisory",
"x_refsource_SREASON"
],
"url": "http://securityreason.com/securityalert/272"
},
{
"name": "15931",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/15931"
},
{
"name": "18190",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/18190/"
},
{
"name": "20051222 XSS\u0026Sql injection attack in PHP-Fusion 6.00.3 Released",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/420109/100/0/threaded"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2005-4516",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in PHP-Fusion 6.00.200 through 6.00.300 allow remote attackers to inject arbitrary web script or HTML via (1) the sortby parameter in members.php and (2) IMG tags."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "ADV-2005-3063",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2005/3063"
},
{
"name": "22050",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/22050"
},
{
"name": "22048",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/22048"
},
{
"name": "272",
"refsource": "SREASON",
"url": "http://securityreason.com/securityalert/272"
},
{
"name": "15931",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/15931"
},
{
"name": "18190",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/18190/"
},
{
"name": "20051222 XSS\u0026Sql injection attack in PHP-Fusion 6.00.3 Released",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/420109/100/0/threaded"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2005-4516",
"datePublished": "2005-12-28T01:00:00.000Z",
"dateReserved": "2005-12-28T00:00:00.000Z",
"dateUpdated": "2024-08-07T23:46:05.512Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2005-4517 (GCVE-0-2005-4517)
Vulnerability from cvelistv5 – Published: 2005-12-28 01:00 – Updated: 2024-08-07 23:46
VLAI
EPSS
VEX
Summary
SQL injection vulnerability in PHP-Fusion 6.00.200 through 6.00.300 allows remote attackers to execute arbitrary SQL commands via the ratings parameter in multiple scripts, such as ratings_include.php.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
5 references
| URL | Tags |
|---|---|
| http://www.vupen.com/english/advisories/2005/3063 | vdb-entryx_refsource_VUPEN |
| http://www.osvdb.org/22049 | vdb-entryx_refsource_OSVDB |
| http://securityreason.com/securityalert/272 | third-party-advisoryx_refsource_SREASON |
| http://secunia.com/advisories/18190/ | third-party-advisoryx_refsource_SECUNIA |
| http://www.securityfocus.com/archive/1/420109/100… | mailing-listx_refsource_BUGTRAQ |
Date Public
2005-12-22 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T23:46:05.541Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "ADV-2005-3063",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2005/3063"
},
{
"name": "22049",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/22049"
},
{
"name": "272",
"tags": [
"third-party-advisory",
"x_refsource_SREASON",
"x_transferred"
],
"url": "http://securityreason.com/securityalert/272"
},
{
"name": "18190",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/18190/"
},
{
"name": "20051222 XSS\u0026Sql injection attack in PHP-Fusion 6.00.3 Released",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/420109/100/0/threaded"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2005-12-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "SQL injection vulnerability in PHP-Fusion 6.00.200 through 6.00.300 allows remote attackers to execute arbitrary SQL commands via the ratings parameter in multiple scripts, such as ratings_include.php."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-19T14:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "ADV-2005-3063",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2005/3063"
},
{
"name": "22049",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/22049"
},
{
"name": "272",
"tags": [
"third-party-advisory",
"x_refsource_SREASON"
],
"url": "http://securityreason.com/securityalert/272"
},
{
"name": "18190",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/18190/"
},
{
"name": "20051222 XSS\u0026Sql injection attack in PHP-Fusion 6.00.3 Released",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/420109/100/0/threaded"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2005-4517",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "SQL injection vulnerability in PHP-Fusion 6.00.200 through 6.00.300 allows remote attackers to execute arbitrary SQL commands via the ratings parameter in multiple scripts, such as ratings_include.php."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "ADV-2005-3063",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2005/3063"
},
{
"name": "22049",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/22049"
},
{
"name": "272",
"refsource": "SREASON",
"url": "http://securityreason.com/securityalert/272"
},
{
"name": "18190",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/18190/"
},
{
"name": "20051222 XSS\u0026Sql injection attack in PHP-Fusion 6.00.3 Released",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/420109/100/0/threaded"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2005-4517",
"datePublished": "2005-12-28T01:00:00.000Z",
"dateReserved": "2005-12-28T00:00:00.000Z",
"dateUpdated": "2024-08-07T23:46:05.541Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2005-4005 (GCVE-0-2005-4005)
Vulnerability from cvelistv5 – Published: 2005-12-05 01:00 – Updated: 2024-08-07 23:31
VLAI
EPSS
VEX
Summary
SQL injection vulnerability in messages.php in PHP-Fusion 6.00.109 allows remote attackers to obtain path information and possibly execute arbitrary SQL commands via the srch_text parameter in a Search and Sort option to messages.php.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
6 references
| URL | Tags |
|---|---|
| http://www.securityfocus.com/bid/15698 | vdb-entryx_refsource_BID |
| http://securityreason.com/securityalert/31 | third-party-advisoryx_refsource_SREASON |
| http://www.osvdb.org/21415 | vdb-entryx_refsource_OSVDB |
| http://www.securityfocus.com/archive/1/418512 | mailing-listx_refsource_BUGTRAQ |
| http://secunia.com/advisories/17871 | third-party-advisoryx_refsource_SECUNIA |
| http://www.vupen.com/english/advisories/2005/2730 | vdb-entryx_refsource_VUPEN |
Date Public
2005-12-03 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T23:31:48.713Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "15698",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/15698"
},
{
"name": "31",
"tags": [
"third-party-advisory",
"x_refsource_SREASON",
"x_transferred"
],
"url": "http://securityreason.com/securityalert/31"
},
{
"name": "21415",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/21415"
},
{
"name": "20051203 PHP-Fusion v6.00.109 SQL Injection and Info. Disclosure",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/418512"
},
{
"name": "17871",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/17871"
},
{
"name": "ADV-2005-2730",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2005/2730"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2005-12-03T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "SQL injection vulnerability in messages.php in PHP-Fusion 6.00.109 allows remote attackers to obtain path information and possibly execute arbitrary SQL commands via the srch_text parameter in a Search and Sort option to messages.php."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2005-12-08T10:00:00.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "15698",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/15698"
},
{
"name": "31",
"tags": [
"third-party-advisory",
"x_refsource_SREASON"
],
"url": "http://securityreason.com/securityalert/31"
},
{
"name": "21415",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/21415"
},
{
"name": "20051203 PHP-Fusion v6.00.109 SQL Injection and Info. Disclosure",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/418512"
},
{
"name": "17871",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/17871"
},
{
"name": "ADV-2005-2730",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2005/2730"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2005-4005",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "SQL injection vulnerability in messages.php in PHP-Fusion 6.00.109 allows remote attackers to obtain path information and possibly execute arbitrary SQL commands via the srch_text parameter in a Search and Sort option to messages.php."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "15698",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/15698"
},
{
"name": "31",
"refsource": "SREASON",
"url": "http://securityreason.com/securityalert/31"
},
{
"name": "21415",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/21415"
},
{
"name": "20051203 PHP-Fusion v6.00.109 SQL Injection and Info. Disclosure",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/418512"
},
{
"name": "17871",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/17871"
},
{
"name": "ADV-2005-2730",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2005/2730"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2005-4005",
"datePublished": "2005-12-05T01:00:00.000Z",
"dateReserved": "2005-12-04T00:00:00.000Z",
"dateUpdated": "2024-08-07T23:31:48.713Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2005-3740 (GCVE-0-2005-3740)
Vulnerability from cvelistv5 – Published: 2005-11-22 11:00 – Updated: 2024-08-07 23:24
VLAI
EPSS
VEX
Summary
Multiple SQL injection vulnerabilities in PHP-Fusion 6.00.206 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the forum_id parameter to options.php or (2) lastvisited parameter to viewforum.php.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
8 references
| URL | Tags |
|---|---|
| http://www.osvdb.org/20992 | vdb-entryx_refsource_OSVDB |
| http://seclists.org/lists/bugtraq/2005/Nov/0237.html | mailing-listx_refsource_BUGTRAQ |
| http://myblog.it-security23.net/advisories/adviso… | x_refsource_MISC |
| http://seclists.org/lists/bugtraq/2005/Nov/0232.html | mailing-listx_refsource_BUGTRAQ |
| http://www.securityfocus.com/bid/15502 | vdb-entryx_refsource_BID |
| http://www.osvdb.org/20991 | vdb-entryx_refsource_OSVDB |
| http://www.vupen.com/english/advisories/2005/2504 | vdb-entryx_refsource_VUPEN |
| http://secunia.com/advisories/17664 | third-party-advisoryx_refsource_SECUNIA |
Date Public
2005-11-21 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T23:24:36.279Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20992",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/20992"
},
{
"name": "20051119 Re: PHP-Fusion \u003c= 6.00.206 Multiple Vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://seclists.org/lists/bugtraq/2005/Nov/0237.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://myblog.it-security23.net/advisories/advisory-6.txt"
},
{
"name": "20051118 PHP-Fusion \u003c= 6.00.206 Multiple Vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://seclists.org/lists/bugtraq/2005/Nov/0232.html"
},
{
"name": "15502",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/15502"
},
{
"name": "20991",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/20991"
},
{
"name": "ADV-2005-2504",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2005/2504"
},
{
"name": "17664",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/17664"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2005-11-21T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Multiple SQL injection vulnerabilities in PHP-Fusion 6.00.206 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the forum_id parameter to options.php or (2) lastvisited parameter to viewforum.php."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2006-01-10T10:00:00.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "20992",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/20992"
},
{
"name": "20051119 Re: PHP-Fusion \u003c= 6.00.206 Multiple Vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://seclists.org/lists/bugtraq/2005/Nov/0237.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://myblog.it-security23.net/advisories/advisory-6.txt"
},
{
"name": "20051118 PHP-Fusion \u003c= 6.00.206 Multiple Vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://seclists.org/lists/bugtraq/2005/Nov/0232.html"
},
{
"name": "15502",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/15502"
},
{
"name": "20991",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/20991"
},
{
"name": "ADV-2005-2504",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2005/2504"
},
{
"name": "17664",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/17664"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2005-3740",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple SQL injection vulnerabilities in PHP-Fusion 6.00.206 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the forum_id parameter to options.php or (2) lastvisited parameter to viewforum.php."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20992",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/20992"
},
{
"name": "20051119 Re: PHP-Fusion \u003c= 6.00.206 Multiple Vulnerabilities",
"refsource": "BUGTRAQ",
"url": "http://seclists.org/lists/bugtraq/2005/Nov/0237.html"
},
{
"name": "http://myblog.it-security23.net/advisories/advisory-6.txt",
"refsource": "MISC",
"url": "http://myblog.it-security23.net/advisories/advisory-6.txt"
},
{
"name": "20051118 PHP-Fusion \u003c= 6.00.206 Multiple Vulnerabilities",
"refsource": "BUGTRAQ",
"url": "http://seclists.org/lists/bugtraq/2005/Nov/0232.html"
},
{
"name": "15502",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/15502"
},
{
"name": "20991",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/20991"
},
{
"name": "ADV-2005-2504",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2005/2504"
},
{
"name": "17664",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/17664"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2005-3740",
"datePublished": "2005-11-22T11:00:00.000Z",
"dateReserved": "2005-11-22T00:00:00.000Z",
"dateUpdated": "2024-08-07T23:24:36.279Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2005-3157 (GCVE-0-2005-3157)
Vulnerability from cvelistv5 – Published: 2005-10-06 04:00 – Updated: 2024-08-07 23:01
VLAI
EPSS
VEX
Summary
SQL injection vulnerability in messages.php in PHP-Fusion 6.00.109 allows remote attackers to execute arbitrary SQL commands via the msg_send parameter, a different vulnerability than CVE-2005-3158 and CVE-2005-3159.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
4 references
| URL | Tags |
|---|---|
| http://secunia.com/advisories/16994 | third-party-advisoryx_refsource_SECUNIA |
| http://rgod.altervista.org/phpfusion600109.html | x_refsource_MISC |
| http://marc.info/?l=bugtraq&m=112793982604963&w=2 | mailing-listx_refsource_BUGTRAQ |
| http://www.php-fusion.co.uk/news.php?readmore=259 | x_refsource_CONFIRM |
Date Public
2005-09-28 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T23:01:57.985Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "16994",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/16994"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://rgod.altervista.org/phpfusion600109.html"
},
{
"name": "20050928 PHP-Fusion v6.00.109 SQL Injection / admin|users credentials",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://marc.info/?l=bugtraq\u0026m=112793982604963\u0026w=2"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.php-fusion.co.uk/news.php?readmore=259"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2005-09-28T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "SQL injection vulnerability in messages.php in PHP-Fusion 6.00.109 allows remote attackers to execute arbitrary SQL commands via the msg_send parameter, a different vulnerability than CVE-2005-3158 and CVE-2005-3159."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2016-10-17T13:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "16994",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/16994"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://rgod.altervista.org/phpfusion600109.html"
},
{
"name": "20050928 PHP-Fusion v6.00.109 SQL Injection / admin|users credentials",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://marc.info/?l=bugtraq\u0026m=112793982604963\u0026w=2"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.php-fusion.co.uk/news.php?readmore=259"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2005-3157",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "SQL injection vulnerability in messages.php in PHP-Fusion 6.00.109 allows remote attackers to execute arbitrary SQL commands via the msg_send parameter, a different vulnerability than CVE-2005-3158 and CVE-2005-3159."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "16994",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/16994"
},
{
"name": "http://rgod.altervista.org/phpfusion600109.html",
"refsource": "MISC",
"url": "http://rgod.altervista.org/phpfusion600109.html"
},
{
"name": "20050928 PHP-Fusion v6.00.109 SQL Injection / admin|users credentials",
"refsource": "BUGTRAQ",
"url": "http://marc.info/?l=bugtraq\u0026m=112793982604963\u0026w=2"
},
{
"name": "http://www.php-fusion.co.uk/news.php?readmore=259",
"refsource": "CONFIRM",
"url": "http://www.php-fusion.co.uk/news.php?readmore=259"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2005-3157",
"datePublished": "2005-10-06T04:00:00.000Z",
"dateReserved": "2005-10-05T00:00:00.000Z",
"dateUpdated": "2024-08-07T23:01:57.985Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2005-3160 (GCVE-0-2005-3160)
Vulnerability from cvelistv5 – Published: 2005-10-06 04:00 – Updated: 2024-08-07 23:01
VLAI
EPSS
VEX
Summary
Multiple SQL injection vulnerabilities in photogallery.php in PHP-Fusion allow remote attackers to execute arbitrary SQL commands via the (1) album and (2) photo parameters.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
2 references
| URL | Tags |
|---|---|
| http://secunia.com/advisories/17048 | third-party-advisoryx_refsource_SECUNIA |
| http://www.osvdb.org/19841 | vdb-entryx_refsource_OSVDB |
Date Public
2005-10-04 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T23:01:58.020Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "17048",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/17048"
},
{
"name": "19841",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/19841"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2005-10-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Multiple SQL injection vulnerabilities in photogallery.php in PHP-Fusion allow remote attackers to execute arbitrary SQL commands via the (1) album and (2) photo parameters."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2006-04-04T09:00:00.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "17048",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/17048"
},
{
"name": "19841",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/19841"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2005-3160",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple SQL injection vulnerabilities in photogallery.php in PHP-Fusion allow remote attackers to execute arbitrary SQL commands via the (1) album and (2) photo parameters."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "17048",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/17048"
},
{
"name": "19841",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/19841"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2005-3160",
"datePublished": "2005-10-06T04:00:00.000Z",
"dateReserved": "2005-10-06T00:00:00.000Z",
"dateUpdated": "2024-08-07T23:01:58.020Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2005-3158 (GCVE-0-2005-3158)
Vulnerability from cvelistv5 – Published: 2005-10-06 04:00 – Updated: 2024-08-07 23:01
VLAI
EPSS
VEX
Summary
SQL injection vulnerability in messages.php in PHP-Fusion 6.00.106 and 6.00.107 allows remote attackers to execute arbitrary SQL commands via the (1) pm_email_notify and (2) pm_save_sent parameters, a different vulnerability than CVE-2005-3157 and CVE-2005-3159.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
2 references
| URL | Tags |
|---|---|
| http://marc.info/?l=bugtraq&m=112801702000944&w=2 | mailing-listx_refsource_BUGTRAQ |
| http://www.gnucitizen.org/writings/php-fusion-mes… | x_refsource_MISC |
Date Public
2005-09-29 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T23:01:58.238Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20050929 Re: PHP-Fusion v6.00.109 SQL Injection / admin|users credentials",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://marc.info/?l=bugtraq\u0026m=112801702000944\u0026w=2"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.gnucitizen.org/writings/php-fusion-messages.php-sql-injection-vulnerability.xhtml"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2005-09-29T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "SQL injection vulnerability in messages.php in PHP-Fusion 6.00.106 and 6.00.107 allows remote attackers to execute arbitrary SQL commands via the (1) pm_email_notify and (2) pm_save_sent parameters, a different vulnerability than CVE-2005-3157 and CVE-2005-3159."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2016-10-17T13:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "20050929 Re: PHP-Fusion v6.00.109 SQL Injection / admin|users credentials",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://marc.info/?l=bugtraq\u0026m=112801702000944\u0026w=2"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.gnucitizen.org/writings/php-fusion-messages.php-sql-injection-vulnerability.xhtml"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2005-3158",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "SQL injection vulnerability in messages.php in PHP-Fusion 6.00.106 and 6.00.107 allows remote attackers to execute arbitrary SQL commands via the (1) pm_email_notify and (2) pm_save_sent parameters, a different vulnerability than CVE-2005-3157 and CVE-2005-3159."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20050929 Re: PHP-Fusion v6.00.109 SQL Injection / admin|users credentials",
"refsource": "BUGTRAQ",
"url": "http://marc.info/?l=bugtraq\u0026m=112801702000944\u0026w=2"
},
{
"name": "http://www.gnucitizen.org/writings/php-fusion-messages.php-sql-injection-vulnerability.xhtml",
"refsource": "MISC",
"url": "http://www.gnucitizen.org/writings/php-fusion-messages.php-sql-injection-vulnerability.xhtml"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2005-3158",
"datePublished": "2005-10-06T04:00:00.000Z",
"dateReserved": "2005-10-05T00:00:00.000Z",
"dateUpdated": "2024-08-07T23:01:58.238Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2005-3161 (GCVE-0-2005-3161)
Vulnerability from cvelistv5 – Published: 2005-10-06 04:00 – Updated: 2024-08-07 23:01
VLAI
EPSS
VEX
Summary
Multiple SQL injection vulnerabilities in PHP-Fusion before 6.00.110 allow remote attackers to execute arbitrary SQL commands via (1) the activate parameter in register.php and (2) the cat_id parameter in faq.php.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
8 references
| URL | Tags |
|---|---|
| http://www.osvdb.org/19867 | vdb-entryx_refsource_OSVDB |
| https://exchange.xforce.ibmcloud.com/vulnerabilit… | vdb-entryx_refsource_XF |
| http://www.osvdb.org/19866 | vdb-entryx_refsource_OSVDB |
| http://www.securityfocus.com/bid/15018 | vdb-entryx_refsource_BID |
| http://secunia.com/secunia_research/2005-52/advisory/ | x_refsource_MISC |
| http://www.php-fusion.co.uk/news.php?readmore=261 | x_refsource_CONFIRM |
| http://securityreason.com/securityalert/54 | third-party-advisoryx_refsource_SREASON |
| http://secunia.com/advisories/17055 | third-party-advisoryx_refsource_SECUNIA |
Date Public
2005-10-04 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T23:01:58.128Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "19867",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/19867"
},
{
"name": "phpfusion-faq-register-sql-injection(22532)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/22532"
},
{
"name": "19866",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/19866"
},
{
"name": "15018",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/15018"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://secunia.com/secunia_research/2005-52/advisory/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.php-fusion.co.uk/news.php?readmore=261"
},
{
"name": "54",
"tags": [
"third-party-advisory",
"x_refsource_SREASON",
"x_transferred"
],
"url": "http://securityreason.com/securityalert/54"
},
{
"name": "17055",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/17055"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2005-10-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Multiple SQL injection vulnerabilities in PHP-Fusion before 6.00.110 allow remote attackers to execute arbitrary SQL commands via (1) the activate parameter in register.php and (2) the cat_id parameter in faq.php."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-10T14:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "19867",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/19867"
},
{
"name": "phpfusion-faq-register-sql-injection(22532)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/22532"
},
{
"name": "19866",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/19866"
},
{
"name": "15018",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/15018"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://secunia.com/secunia_research/2005-52/advisory/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.php-fusion.co.uk/news.php?readmore=261"
},
{
"name": "54",
"tags": [
"third-party-advisory",
"x_refsource_SREASON"
],
"url": "http://securityreason.com/securityalert/54"
},
{
"name": "17055",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/17055"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2005-3161",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple SQL injection vulnerabilities in PHP-Fusion before 6.00.110 allow remote attackers to execute arbitrary SQL commands via (1) the activate parameter in register.php and (2) the cat_id parameter in faq.php."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "19867",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/19867"
},
{
"name": "phpfusion-faq-register-sql-injection(22532)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/22532"
},
{
"name": "19866",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/19866"
},
{
"name": "15018",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/15018"
},
{
"name": "http://secunia.com/secunia_research/2005-52/advisory/",
"refsource": "MISC",
"url": "http://secunia.com/secunia_research/2005-52/advisory/"
},
{
"name": "http://www.php-fusion.co.uk/news.php?readmore=261",
"refsource": "CONFIRM",
"url": "http://www.php-fusion.co.uk/news.php?readmore=261"
},
{
"name": "54",
"refsource": "SREASON",
"url": "http://securityreason.com/securityalert/54"
},
{
"name": "17055",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/17055"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2005-3161",
"datePublished": "2005-10-06T04:00:00.000Z",
"dateReserved": "2005-10-06T00:00:00.000Z",
"dateUpdated": "2024-08-07T23:01:58.128Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}