Search

Find a vulnerability

Search criteria

    22 vulnerabilities by Maian

    GCVE-1988-2026-0488

    Vulnerability from gna-1988 – Published: 2026-11-02 07:30 – Updated: 2026-11-02 07:30
    VLAI
    Title
    [0day-rubbish] Maian Pal 2.1 product image upload with no extension allow-list to PHP webshell and www-data uid 33 code execution (7.2, PR:H)
    Summary
    0day Rubbish Research Team is publicly disclosing a vulnerability in Maian Pal 2.1, the self-hosted PHP shopping-cart script from Maian Media (United Kingdom), oriented at PayPal checkout and distributed as a commercial closed-source archive, verified end to end against a real installation of that version in three independent reproductions. Type: unrestricted upload of a file with a dangerous type (CWE-434 primary, with CWE-94 and CWE-693 contributing - the stored object is subsequently interpreted as code, and the served upload directory lacks the execution restriction that equivalent directories in the same product carry), realised as OS command execution (CWE-78 describes what the demonstration payload does once it runs and is not scored separately). The product-image handling of the administration product create and update operations, `ajax-ops=add` and `ajax-ops=add-edit`, passes the multipart field fm[ifile][] to products::pictures() at `class.products.php:333` through `class.products.php:410`. The stored name is chosen from the client-supplied filename by a single ternary: // class.products.php:372 - no extension allow-list anywhere on this path $picPath = ($cfg['rename'] == 'yes' ? $cfg['imgprf'] . $ID . '-' . $nextPic . strrchr($name, '.') : $name); // class.products.php:~390 - written before any validation move_uploaded_file($temp, $picFldr . '/' . $picPath); With $cfg supplied by thumbcfg() at `class.products.php:615`, whose shipped default is 'rename' => 'no', that assignment reduces to $picPath = $name, so the client controls the entire stored name including the extension and a .php file lands on disk intact as content/products/<ID>/<name>.php. There is no extension allow-list and no deny-list, no finfo or MIME verification, no re-encoding to strip an embedded payload, no server-generated filename with a type-derived extension, and no rollback of the write when later validation fails. strtolower() appears only in the non-default rename='yes' branch and is cosmetic. The root cause has two independently fixable halves, and this advisory keeps them separate because fixing one without the other leaves the chain standing. The first half is the handler: what may be written. The second is the directory: whether what is written may execute. That second half lines up in this product because the destination sits inside the document root and the front-controller rewrite claims only paths that do not exist on disk - `RewriteCond !-f` guarding `RewriteRule ^([^?]*) index.php?_msw_=$1 [L,QSA]` - so a file that exists is handed straight to the PHP handler, and requesting it with a query string executes it. Nothing in content/products/ disables that handler. Our review of the shipped tree found an Apache deny file carrying `Deny from all` present in admin/import/, and found content/products/ carrying no such file. The contrast that makes this an omission rather than a design decision is inside one product and one shipped version: two handlers accept files from a browser, and one of them checks the extension and writes into a deny-protected directory while the other does neither. We are precise about the evidentiary weight of each half of that comparison, because it matters. That admin/import/ carries `Deny from all` and that content/products/ carries nothing are both anchored artefacts of the shipped tree. The statement that the product's attachment upload path applies an extension allow-list into a deny-protected directory is a source-level reading of the shipped PHP that we did not reduce to a line citation, and we label it as such. It is offered here the same way we put it to the seller: as a contrast worth confirming, since part of the argument that this is an omission rests on it. The ordering inside the handler makes the failure path worse rather than safer, and this is the detail most likely to be missed by a fix that only adds a check downstream. move_uploaded_file() runs before any thumbnail inspection, and the validation that does run is not fatal. getimagesize() inside thumbnail() runs after the write and is used only to select a thumbnail strategy, never to accept or reject the upload; for a PHP file it fails, the switch falls through to a suppressed @copy(), and the original is never unlinked. So a non-image upload leaves two objects in a served directory - the original plus a tmb_-prefixed sibling - deletes neither, and still reports {"status":"ok"}. The failure path yields two files rather than zero, silently. Any cleanup that removes only the obviously named object leaves the second one behind. Turning rename on would not fix this either, and it deserves emphasis because it is the obvious operator-facing knob: in the rename='yes' branch the stem is server-generated but the extension is still taken from the client filename via strrchr(), so a .php upload produces a server-named file that is still executable. We derived that from the assignment expression and did not run the rename='yes' configuration, so it is an argument from code rather than a dynamic result. Commands execute as the web server service account, observed as `uid=33(www-data) gid=33(www-data) groups=33(www-data)` in three independent reproductions with distinct random filenames, plus a marker written to an absolute path outside the document root and read back afterwards from the host. No privilege escalation of any kind was attempted or observed: no kernel exploit, no sudo right, no writable service unit, no container escape. Root was not reached and is not claimed; the ceiling of this finding is code execution as the web server user. How confirmation works. The chain is two requests. One POST creates the object and the create response itself embeds `?p=add&id=<ID>`, so the attacker learns the numeric product directory without guessing and the filename is one they chose - predictability of the final URL is total. One GET to `/content/products/<ID>/<name>.php?cmd=<command>` executes it and returns the output in the response body, prefixed by a marker that proves the body came from PHP execution rather than from static file serving. Both operations report {"status":"ok"}. What was deliberately not reproduced: no data theft, no database modification, no persistence beyond the uploaded file, no lateral movement and no exploitation of a live third-party system - all verification targeted our own instance, and the payload's default command is a non-destructive identity query. Scoring. One score is published: 7.2 High, CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, the CVSS 3.1 base arithmetic for which is shown in full in the advisory and was re-checked against an independent implementation of that formula. AV:N because the sink sits on the product's ordinary HTTP(S) listener, with no separate management port, no RPC endpoint and no background listener, and nothing in the chain depends on source address, user agent or session age beyond validity. AC:L because one POST creates the object and one GET executes it, so there is no race window, no multi-step state to prepare and no unusual configuration requirement: the chain depends only on shipped defaults (thumbcfg() 'rename' => 'no', no deny file in content/products/), and the licence restriction RESTR_PRODUCTS = 50 does not obstruct the first product create. UI:N because no victim browser or user action is involved - the attacker authenticates with their own credentials and there is no forgery step. PR:H is published because only an authenticated administrator session was demonstrated. The credential pair is the one the installer provisions (LG_USER and LG_PASS in `control/_cfg.php`), mswPerms() gates every administration operation except login and logout, and no graduated back-end role was shown to reach ajax-ops=add. Four named alternative readings are published against that 7.2 so that each rejection is auditable, and one of them is conditional rather than rejected: - Scope Changed, AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H = 9.1. Rejected. The vulnerable component is the administration back-end and the impacted resources are that application's own files, its own database reached with the very credentials the application holds, and the operating-system context of the web server process it runs inside. The achieved identity is the same service account the application always ran as, on the same host, and nothing outside its reach before the upload came into reach afterwards. Publishing S:C would require a database-server compromise independent of the application's credentials, a container escape or a distinct host, and none was demonstrated. - Unauthenticated, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8. Rejected, and this is the tempting headline for a public-facing shopping cart that we decline to print as ours. The storefront dispatcher's 56 unauthenticated AJAX operations contain no file-upload, command-execution, code-evaluation or deserialization primitive - only include() of language and class files - the administration login was reviewed on six specific bypass axes with no success, and the product ships no factory credential and no usable SECRET_KEY. - Lower-privileged back-end role, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8. Published as a conditional reading, labelled as such and never as the headline. The dispatcher exposes users, users-edit, permissions and permissions-edit, so the product may model back-end accounts narrower than the single installer-provisioned administrator; mswPerms() was established in our review only as an authentication gate over the dispatch, not as a per-operation authorization matrix; and no principal short of full administrator was demonstrated reaching ajax-ops=add. If a restricted back-end account can create or update products, that account is the least-privileged principal reaching the sink and PR:L is the faithful metric, at Impact 5.87311872 plus Exploitability 2.83525473, base 8.70837345, rounded up. We did not round our rating up to it, because doing so would assert a privilege model we did not observe. - Elevated complexity, AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H = 6.6, and user interaction, AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H = 6.8. Both printed only so the rejections are inspectable: there is no race, no ordering constraint beyond one POST and one GET, no requirement that the target be in an unusual state, and no victim action at any point in the chain. Contributing weaknesses are reported and deliberately not scored into the vector: the single-round SHA-1 mswEnc() credential transform, loose `==` comparisons on hash and token strings, the absence of any enforced rotation of the installer-provisioned secret, and the inconsistency between upload handlers inside one shipped version. None of them lowers the privilege required to reach the sink and none raises the impact of the upload once it is reached. There is also no numeric base score in our own record against this vector that could disagree with it, so no correction notice accompanies the figure. Authentication: post-authentication administrator plus the session CSRF token, and both gates were treated as things to attack rather than as configuration to trust. There are no factory credentials in Maian Pal 2.1: the installer forces LG_USER, LG_PASS and SECRET_KEY to be set, `control/_cfg-sample.php:62` ships only the placeholder text "Your secret key value goes here", and this is not a default-credential report. The login path was reviewed for a missing or permissive permission configuration, a route that skips the gate, a predictable CSRF token, a pre-computable credential hash, a factory-credential fallback, a comparison-timing difference and a secondary authentication branch, and none was found; t
    Severity
    No CVSS data available.
    CWE
    Assigner
    VULNARCHIVE GNA GNA-1988
    GNA scorecard E 38/100 over 576 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    Maian Pal Affected: unknown
    		Create a notification for this product.
    Credits
    disclosure via Fulldisclosure
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Pal",
          "vendor": "Maian",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in Maian Pal\n2.1, the self-hosted PHP shopping-cart script from Maian Media (United Kingdom),\noriented at PayPal checkout and distributed as a commercial closed-source archive,\nverified end to end against a real installation of that version in three\nindependent reproductions.\n\nType: unrestricted upload of a file with a dangerous type (CWE-434 primary, with\nCWE-94 and CWE-693 contributing - the stored object is subsequently interpreted as\ncode, and the served upload directory lacks the execution restriction that\nequivalent directories in the same product carry), realised as OS command\nexecution (CWE-78 describes what the demonstration payload does once it runs and\nis not scored separately). The product-image handling of the administration\nproduct create and update operations, `ajax-ops=add` and `ajax-ops=add-edit`,\npasses the multipart field fm[ifile][] to products::pictures() at\n`class.products.php:333` through `class.products.php:410`. The stored name is\nchosen from the client-supplied filename by a single ternary:\n\n    // class.products.php:372  - no extension allow-list anywhere on this path\n    $picPath = ($cfg[\u0027rename\u0027] == \u0027yes\u0027\n                ? $cfg[\u0027imgprf\u0027] . $ID . \u0027-\u0027 . $nextPic . strrchr($name, \u0027.\u0027)\n                : $name);\n\n    // class.products.php:~390  - written before any validation\n    move_uploaded_file($temp, $picFldr . \u0027/\u0027 . $picPath);\n\nWith $cfg supplied by thumbcfg() at `class.products.php:615`, whose shipped\ndefault is \u0027rename\u0027 =\u003e \u0027no\u0027, that assignment reduces to $picPath = $name, so the\nclient controls the entire stored name including the extension and a .php file\nlands on disk intact as content/products/\u003cID\u003e/\u003cname\u003e.php. There is no extension\nallow-list and no deny-list, no finfo or MIME verification, no re-encoding to\nstrip an embedded payload, no server-generated filename with a type-derived\nextension, and no rollback of the write when later validation fails. strtolower()\nappears only in the non-default rename=\u0027yes\u0027 branch and is cosmetic.\n\nThe root cause has two independently fixable halves, and this advisory keeps them\nseparate because fixing one without the other leaves the chain standing.\n\nThe first half is the handler: what may be written. The second is the directory:\nwhether what is written may execute. That second half lines up in this product\nbecause the destination sits inside the document root and the front-controller\nrewrite claims only paths that do not exist on disk - `RewriteCond !-f` guarding\n`RewriteRule ^([^?]*) index.php?_msw_=$1 [L,QSA]` - so a file that exists is handed\nstraight to the PHP handler, and requesting it with a query string executes it.\nNothing in content/products/ disables that handler. Our review of the shipped tree\nfound an Apache deny file carrying `Deny from all` present in admin/import/, and\nfound content/products/ carrying no such file.\n\nThe contrast that makes this an omission rather than a design decision is inside\none product and one shipped version: two handlers accept files from a browser, and\none of them checks the extension and writes into a deny-protected directory while\nthe other does neither. We are precise about the evidentiary weight of each half\nof that comparison, because it matters. That admin/import/ carries `Deny from all`\nand that content/products/ carries nothing are both anchored artefacts of the\nshipped tree. The statement that the product\u0027s attachment upload path applies an\nextension allow-list into a deny-protected directory is a source-level reading of\nthe shipped PHP that we did not reduce to a line citation, and we label it as\nsuch. It is offered here the same way we put it to the seller: as a contrast worth\nconfirming, since part of the argument that this is an omission rests on it.\n\nThe ordering inside the handler makes the failure path worse rather than safer,\nand this is the detail most likely to be missed by a fix that only adds a check\ndownstream. move_uploaded_file() runs before any thumbnail inspection, and the\nvalidation that does run is not fatal. getimagesize() inside thumbnail() runs\nafter the write and is used only to select a thumbnail strategy, never to accept\nor reject the upload; for a PHP file it fails, the switch falls through to a\nsuppressed @copy(), and the original is never unlinked. So a non-image upload\nleaves two objects in a served directory - the original plus a tmb_-prefixed\nsibling - deletes neither, and still reports {\"status\":\"ok\"}. The failure path\nyields two files rather than zero, silently. Any cleanup that removes only the\nobviously named object leaves the second one behind.\n\nTurning rename on would not fix this either, and it deserves emphasis because it\nis the obvious operator-facing knob: in the rename=\u0027yes\u0027 branch the stem is\nserver-generated but the extension is still taken from the client filename via\nstrrchr(), so a .php upload produces a server-named file that is still\nexecutable. We derived that from the assignment expression and did not run the\nrename=\u0027yes\u0027 configuration, so it is an argument from code rather than a dynamic\nresult.\n\nCommands execute as the web server service account, observed as\n`uid=33(www-data) gid=33(www-data) groups=33(www-data)` in three independent\nreproductions with distinct random filenames, plus a marker written to an absolute\npath outside the document root and read back afterwards from the host. No\nprivilege escalation of any kind was attempted or observed: no kernel exploit, no\nsudo right, no writable service unit, no container escape. Root was not reached\nand is not claimed; the ceiling of this finding is code execution as the web\nserver user.\n\nHow confirmation works. The chain is two requests. One POST creates the object\nand the create response itself embeds `?p=add\u0026id=\u003cID\u003e`, so the attacker learns\nthe numeric product directory without guessing and the filename is one they\nchose - predictability of the final URL is total. One GET to\n`/content/products/\u003cID\u003e/\u003cname\u003e.php?cmd=\u003ccommand\u003e` executes it and returns the\noutput in the response body, prefixed by a marker that proves the body came from\nPHP execution rather than from static file serving. Both operations report\n{\"status\":\"ok\"}. What was deliberately not reproduced: no data theft, no database\nmodification, no persistence beyond the uploaded file, no lateral movement and no\nexploitation of a live third-party system - all verification targeted our own\ninstance, and the payload\u0027s default command is a non-destructive identity query.\n\nScoring. One score is published: 7.2 High,\nCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, the CVSS 3.1 base arithmetic for\nwhich is shown in full in the advisory and was re-checked against an independent\nimplementation of that formula. AV:N because the sink sits on the product\u0027s\nordinary HTTP(S) listener, with no separate management port, no RPC endpoint and\nno background listener, and nothing in the chain depends on source address, user\nagent or session age beyond validity. AC:L because one POST creates the object and\none GET executes it, so there is no race window, no multi-step state to prepare and\nno unusual configuration requirement: the chain depends only on shipped defaults\n(thumbcfg() \u0027rename\u0027 =\u003e \u0027no\u0027, no deny file in content/products/), and the licence\nrestriction RESTR_PRODUCTS = 50 does not obstruct the first product create. UI:N\nbecause no victim browser or user action is involved - the attacker authenticates\nwith their own credentials and there is no forgery step.\n\nPR:H is published because only an authenticated administrator session was\ndemonstrated. The credential pair is the one the installer provisions (LG_USER\nand LG_PASS in `control/_cfg.php`), mswPerms() gates every administration\noperation except login and logout, and no graduated back-end role was shown to\nreach ajax-ops=add. Four named alternative readings are published against that\n7.2 so that each rejection is auditable, and one of them is conditional rather\nthan rejected:\n\n  - Scope Changed, AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H = 9.1. Rejected. The\n      vulnerable component is the administration back-end and the impacted\n      resources are that application\u0027s own files, its own database reached with\n      the very credentials the application holds, and the operating-system\n      context of the web server process it runs inside. The achieved identity is\n      the same service account the application always ran as, on the same host,\n      and nothing outside its reach before the upload came into reach\n      afterwards. Publishing S:C would require a database-server compromise\n      independent of the application\u0027s credentials, a container escape or a\n      distinct host, and none was demonstrated.\n  - Unauthenticated, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8. Rejected, and\n      this is the tempting headline for a public-facing shopping cart that we\n      decline to print as ours. The storefront dispatcher\u0027s 56 unauthenticated\n      AJAX operations contain no file-upload, command-execution, code-evaluation\n      or deserialization primitive - only include() of language and class files -\n      the administration login was reviewed on six specific bypass axes with no\n      success, and the product ships no factory credential and no usable\n      SECRET_KEY.\n  - Lower-privileged back-end role, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8.\n      Published as a conditional reading, labelled as such and never as the\n      headline. The dispatcher exposes users, users-edit, permissions and\n      permissions-edit, so the product may model back-end accounts narrower than\n      the single installer-provisioned administrator; mswPerms() was established\n      in our review only as an authentication gate over the dispatch, not as a\n      per-operation authorization matrix; and no principal short of full\n      administrator was demonstrated reaching ajax-ops=add. If a restricted\n      back-end account can create or update products, that account is the\n      least-privileged principal reaching the sink and PR:L is the faithful\n      metric, at Impact 5.87311872 plus Exploitability 2.83525473, base\n      8.70837345, rounded up. We did not round our rating up to it, because\n      doing so would assert a privilege model we did not observe.\n  - Elevated complexity, AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H = 6.6, and user\n      interaction, AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H = 6.8. Both printed only\n      so the rejections are inspectable: there is no race, no ordering constraint\n      beyond one POST and one GET, no requirement that the target be in an\n      unusual state, and no victim action at any point in the chain.\n\nContributing weaknesses are reported and deliberately not scored into the vector:\nthe single-round SHA-1 mswEnc() credential transform, loose `==` comparisons on\nhash and token strings, the absence of any enforced rotation of the\ninstaller-provisioned secret, and the inconsistency between upload handlers inside\none shipped version. None of them lowers the privilege required to reach the sink\nand none raises the impact of the upload once it is reached. There is also no\nnumeric base score in our own record against this vector that could disagree with\nit, so no correction notice accompanies the figure.\n\nAuthentication: post-authentication administrator plus the session CSRF token, and\nboth gates were treated as things to attack rather than as configuration to trust.\nThere are no factory credentials in Maian Pal 2.1: the installer forces LG_USER,\nLG_PASS and SECRET_KEY to be set, `control/_cfg-sample.php:62` ships only the\nplaceholder text \"Your secret key value goes here\", and this is not a\ndefault-credential report. The login path was reviewed for a missing or permissive\npermission configuration, a route that skips the gate, a predictable CSRF token, a\npre-computable credential hash, a factory-credential fallback, a\ncomparison-timing difference and a secondary authentication branch, and none was\nfound; t"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-434",
              "description": "CWE-434",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-693",
              "description": "CWE-693",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-78",
              "description": "CWE-78",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-94",
              "description": "CWE-94",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-02T07:30:02Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Oct/17"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Oct/17"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/maian-pal-product-image-upload-webshell-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Oct/17"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[0day-rubbish] Maian Pal 2.1 product image upload with no extension allow-list to PHP webshell and www-data uid 33 code execution (7.2, PR:H)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0488",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Oct/17",
            "automated": true,
            "contentSha256": "0b3e889b1e4a4dcd1911310cb807a8368fb210a07e78930cca78dfad7f6238a2",
            "evidenceScore": 11,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Oct/17",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-10-13T02:22:02Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-11-02T07:30:02Z",
    "dateUpdated": "2026-11-02T07:30:02Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0488"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    GCVE-1988-2026-0487

    Vulnerability from gna-1988 – Published: 2026-11-02 07:30 – Updated: 2026-11-02 07:30
    VLAI
    Title
    [0day-rubbish] Maian Guardian 2.1 license generator projid command injection to www-data uid 33 code execution (7.2, PR:H)
    Summary
    0day Rubbish Research Team is publicly disclosing a vulnerability in Maian Guardian 2.1, the self-hosted licensing system for PHP applications encoded with SourceGuardian, distributed as a closed-source commercial PHP script by Maian Script World (United Kingdom) and verified end to end against a real installation of that version. Type: OS command injection (CWE-78 primary; CWE-116, CWE-20 and CWE-561 contributing; CWE-250 and CWE-732 as environmental amplifiers of the same event). The license-generation routine builds an operating-system command line by string interpolation and passes it to shell_exec() at `control/classes/class.licensing.php:261` inside `guardianLicense::create()`, in order to invoke the external SourceGuardian generator binary. Several of the interpolated fields arrive unvalidated from the body of the administrator AJAX operation `POST /admin/index.php?ajax-ops=generate` - projid, projkey, the license property key and value pairs, and the encoder string - and are placed inside double quotes rather than argument-quoted, so POSIX command substitution still applies: shell_exec(mswSGLicGenPath('"', $this->settings) . " $string $output"); $lock[] = '--projid "' . $this->projid . '"'; // line 112 $lock[] = '--projkey "' . $this->projkey . '"'; // line 113 The rendered command line is therefore `"<licpath>" --projid "<PROJID>" --projkey "<PROJKEY>" --const "<KEY>=<VALUE>" ... <output>`, where PROJID is whatever an authenticated administrator posted. PHP hands that text to `/bin/sh -c`, and inside a double-quoted word the shell does not treat `$(`, a backtick or a backslash as literal. A projid of `$(id)` spawns `id` in a subshell and substitutes its output into the argument, and it does so during expansion, before the command word is resolved - which is why a deployment with a missing or misconfigured generator binary is still fully exploitable. The decisive detail is the sanitizer arrangement, and it is the whole root cause. Three sanitizer-shaped helpers ship with the product; two of them return their input unchanged and sit in series on the path to the shell, and the one that correctly wraps escapeshellarg has no call site anywhere in the product: private function escape($data) { return $data; } // lines 68-70 private function escapeArg($data) { return escapeshellarg($data); } // lines 72-74 `escape()` is the function actually called on the way to the shell, and it does nothing. `mswCD()` at lines 152-154 is a second `return $data;`, applied to the property key and value immediately before `escape()`, so two no-ops are stacked in a row on the properties path. `escapeArg()` wraps exactly the right primitive and is dead code: a sweep of all 308 PHP files in the shipped tree found no call site for it, which reads as a completed remediation that never landed. A fourth helper, `escapeCmd()` around `escapeshellcmd()`, is real and is invoked, but only from `head()`, `time_servers()` and `add_lic_info()` - never from `lock()` or `properties()` - so it guards the fields with the least attacker control and never sees the two that carry project identifiers. Upstream of the class the only request-wide filter is `mswMDAM('trim', $_POST)` at `control/functions.php:342`, which applies trim() and nothing else; there is no character allow-list, no length cap and no metacharacter rejection anywhere between the POST body and the shell_exec() argument. Commands execute as the web server service account, observed as `uid=33(www-data) gid=33(www-data) groups=33(www-data)`. No setuid transition, wrapper, privilege drop or sandbox sits between the web worker and the child process. Root was not reached, was not attempted, and is not claimed. How confirmation works, and what was deliberately not reproduced. The generate operation does not echo command output into its HTTP response: it answered HTTP 200 with its ordinary `{"status":"rdr"}` body, the response shape it produces when the generator creates no valid license file. Proof of execution is therefore out-of-band by construction. The injected command writes a marker file and the same installation serves it back over HTTP; one authenticated request executed six distinct commands into that single file, including a pipeline, `cat /etc/passwd | head -3`, which is what separates arbitrary command execution from one hard-coded effect. An earlier iteration of the same chain wrote its marker outside the document root and was confirmed there first, so write capability is stated as observed both inside and outside the web tree. The published advisory reproduces the identity string but elides the container hostname and the kernel build-timestamp field of the `uname -a` line, since both are artefacts of one execution on one host rather than evidence about the product. Scoring. One score is published: 7.2 High, CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. That vector computes from first principles to ISS = 1 - (0.44 x 0.44 x 0.44) = 0.914816, Impact(S:U) = 6.42 x 0.914816 = 5.87311872, Exploitability = 8.22 x 0.85 x 0.77 x 0.27 x 0.85 = 1.234707705, base 7.107826425, taken to 7.2 by the CVSS ceiling-to-tenth Roundup - a calculator reporting 7.1 is disagreeing with the rounding rule and with nothing else. AV:N describes the product's exposure and not our lab's: the chain is three HTTP requests plus one read-back against the product's single listener, and the loopback binding in our testbed was our own safety choice, not a product property. AC:L because nothing outside the attacker's or a normal deployment's control is needed - ENC_DEBUG is at its shipped value 0 (`control/options.php:37`), which selects the shell_exec() branch, and the license-generator path is a setting a functioning installation already has. PR:H is the metric carrying the weight, and the readings on either side of it are printed with their own vectors so the arithmetic is inspectable. Published reason: only an installer-provisioned administrator session was demonstrated reaching the sink. The product does keep a `guard_staff` table, so a multi-user deployment is possible, but our review found no role or permission column that separates license generation from any other administrator operation and no documented staff role with a narrower capability set; every path we traced to `guardianLicense::create()` sat behind the administrator gate with the same operation-level CSRF check. Three alternative readings are therefore labelled and rejected rather than hidden: - Unauthenticated, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8. Rejected: no unauthenticated path reaches a sink. The remote license-issuing API at `control/api/api-remote.php` is gated by a key randomly generated at install time, which was not bypassed, and the product ships no factory credential because the installer sets the administrator account. - Lower-privileged operator, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8. Rejected: no role-separated principal was demonstrated reaching the generate operation, and the guard_staff role model was not established. Publishing this would rest on an unstudied possibility rather than on a demonstrated principal. - Scope Changed, AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H = 9.1. Rejected: the injected command runs as the same identity, on the same host, inside the same authority the product was granted at install time. No second authorization boundary was crossed and no cross-machine or cross-account outcome was demonstrated, so S:C would rate an outcome the evidence does not contain. Two things are deliberately priced at zero in this vector. The remote API key comparison `md5($apiKey) == md5($SETTINGS->apikey)` is reported as a separate hardening weakness - CWE-328 with a CWE-208 aspect, since hashing both sides with an unsalted MD5 adds nothing over comparing the raw key and `==` on two digests is not a constant-time comparison - and it is folded into nothing. It was not demonstrated to be exploitable, the strength of that gate rests on the entropy of the install-time random key, and no leak path for it was found. Likewise the six additional tainted fields on the same sink and the second entry point widen the patch surface a vendor must cover without changing how hard the demonstrated injection is to perform, so they contribute nothing to the score. No correction notice accompanies this figure: our own notes carry no numeric CVSS value for this finding, so 7.2 is derived from the vector above and nothing else. Authentication: post-authentication administrator, and the gate held. Every administrator page and every administrator AJAX operation passes through one init-level gate at `admin/control/init.php:122`, which is a hard include-time gate rather than a per-request filter that can be forgotten on one route, and the generate case carries a second operation-level check that the submitted `cs_rf` body field or `csrf` header matches the session-bound `csrf_token`. Eight candidate bypasses were examined and all eight recorded as blocked: forging the `guardian_access` session value (it embeds the per-install random SECRET_KEY), omitting or replaying the CSRF token (session-bound, validated per operation, rotated per page render), injecting the internal `$loginBypass` variable (no external input reaches it), SQL injection in the login path (the staff lookup is parameterised and the constant path compares salted SHA-1 digests), a timing attack on that comparison (equal-length hex digests, no exploitable divergence identified), a default-credential fallback (the installer forces the operator to set it), hard-coded LG_USER or LG_PASS (written at install time from operator input, not compiled in), and guessing the remote API key (randomly generated at install). The unauthenticated surface was enumerated interface by interface and parameter by parameter: roughly sixty-two interfaces were inventoried by three independent methods that agreed, roughly nine answer without credentials (four static asset trees, the buyer portal front page and its license-lookup operation, the remote API endpoint refusing a keyless request, the post-installation installer route, and the login operation itself), and zero of those nine reach a command-execution, deserialization or file-write sink. Every parameter of every unauthenticated interface was tested for traversal, injection, type confusion, over-long input and encoding bypass. Unauthenticated remote code execution was not reached and none is claimed. One honesty point about the negative control, because the published exploit carries a control mode that was never recorded. The script ships a --control mode that repeats the identical authenticated sequence - same login, same fresh CSRF token, same generate operation, same field set including a non-empty licpath and a key/value pair - with a benign project identifier and project key, points its read-back at a marker name it never injects, and asserts that the marker URL does not answer. A passing control would rule out that the proof file pre-existed, that the generate operation writes arbitrary attacker-named files into the document root as a normal side effect, and that the read-back URL is served by something other than the written file. What there is not, and what this post does not pretend otherwise, is an archived control transcript: the recorded verification output is the injection leg, the control leg is shipped so that any reader can execute it against their own instance, and inventing a transcript would be worse than saying so. The structural half of the control does come from source: the only thing on this path that creates a file inside the document root is the shell command assembled at `class.licensing.php:261`, and no branch of the generate operation writes to the content tree on its own. Impact: arbitrary OS
    Severity
    No CVSS data available.
    CWE
    Assigner
    VULNARCHIVE GNA GNA-1988
    GNA scorecard E 38/100 over 576 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    Maian Guardian Affected: unknown
    		Create a notification for this product.
    Credits
    disclosure via Fulldisclosure
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Guardian",
          "vendor": "Maian",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in Maian\nGuardian 2.1, the self-hosted licensing system for PHP applications encoded\nwith SourceGuardian, distributed as a closed-source commercial PHP script by\nMaian Script World (United Kingdom) and verified end to end against a real\ninstallation of that version.\n\nType: OS command injection (CWE-78 primary; CWE-116, CWE-20 and CWE-561\ncontributing; CWE-250 and CWE-732 as environmental amplifiers of the same\nevent). The license-generation routine builds an operating-system command line\nby string interpolation and passes it to shell_exec() at\n`control/classes/class.licensing.php:261` inside `guardianLicense::create()`, in\norder to invoke the external SourceGuardian generator binary. Several of the\ninterpolated fields arrive unvalidated from the body of the administrator AJAX\noperation `POST /admin/index.php?ajax-ops=generate` - projid, projkey, the\nlicense property key and value pairs, and the encoder string - and are placed\ninside double quotes rather than argument-quoted, so POSIX command substitution\nstill applies:\n\n    shell_exec(mswSGLicGenPath(\u0027\"\u0027, $this-\u003esettings) . \" $string $output\");\n    $lock[] = \u0027--projid \"\u0027  . $this-\u003eprojid  . \u0027\"\u0027;   // line 112\n    $lock[] = \u0027--projkey \"\u0027 . $this-\u003eprojkey . \u0027\"\u0027;   // line 113\n\nThe rendered command line is therefore\n`\"\u003clicpath\u003e\" --projid \"\u003cPROJID\u003e\" --projkey \"\u003cPROJKEY\u003e\" --const \"\u003cKEY\u003e=\u003cVALUE\u003e\"\n... \u003coutput\u003e`, where PROJID is whatever an authenticated administrator posted.\nPHP hands that text to `/bin/sh -c`, and inside a double-quoted word the shell\ndoes not treat `$(`, a backtick or a backslash as literal. A projid of `$(id)`\nspawns `id` in a subshell and substitutes its output into the argument, and it\ndoes so during expansion, before the command word is resolved - which is why a\ndeployment with a missing or misconfigured generator binary is still fully\nexploitable.\n\nThe decisive detail is the sanitizer arrangement, and it is the whole root\ncause. Three sanitizer-shaped helpers ship with the product; two of them return\ntheir input unchanged and sit in series on the path to the shell, and the one\nthat correctly wraps escapeshellarg has no call site anywhere in the product:\n\n    private function escape($data) {     return $data; }   // lines 68-70\n    private function escapeArg($data) { return escapeshellarg($data); }\n                                                           // lines 72-74\n\n`escape()` is the function actually called on the way to the shell, and it does\nnothing. `mswCD()` at lines 152-154 is a second `return $data;`, applied to the\nproperty key and value immediately before `escape()`, so two no-ops are stacked\nin a row on the properties path. `escapeArg()` wraps exactly the right primitive\nand is dead code: a sweep of all 308 PHP files in the shipped tree found no call\nsite for it, which reads as a completed remediation that never landed. A fourth\nhelper, `escapeCmd()` around `escapeshellcmd()`, is real and is invoked, but only\nfrom `head()`, `time_servers()` and `add_lic_info()` - never from `lock()` or\n`properties()` - so it guards the fields with the least attacker control and\nnever sees the two that carry project identifiers. Upstream of the class the\nonly request-wide filter is `mswMDAM(\u0027trim\u0027, $_POST)` at\n`control/functions.php:342`, which applies trim() and nothing else; there is no\ncharacter allow-list, no length cap and no metacharacter rejection anywhere\nbetween the POST body and the shell_exec() argument.\n\nCommands execute as the web server service account, observed as\n`uid=33(www-data) gid=33(www-data) groups=33(www-data)`. No setuid transition,\nwrapper, privilege drop or sandbox sits between the web worker and the child\nprocess. Root was not reached, was not attempted, and is not claimed.\n\nHow confirmation works, and what was deliberately not reproduced. The generate\noperation does not echo command output into its HTTP response: it answered HTTP\n200 with its ordinary `{\"status\":\"rdr\"}` body, the response shape it produces\nwhen the generator creates no valid license file. Proof of execution is\ntherefore out-of-band by construction. The injected command writes a marker file\nand the same installation serves it back over HTTP; one authenticated request\nexecuted six distinct commands into that single file, including a pipeline,\n`cat /etc/passwd | head -3`, which is what separates arbitrary command execution\nfrom one hard-coded effect. An earlier iteration of the same chain wrote its\nmarker outside the document root and was confirmed there first, so write\ncapability is stated as observed both inside and outside the web tree. The\npublished advisory reproduces the identity string but elides the container\nhostname and the kernel build-timestamp field of the `uname -a` line, since both\nare artefacts of one execution on one host rather than evidence about the\nproduct.\n\nScoring. One score is published: 7.2 High,\nCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. That vector computes from first\nprinciples to ISS = 1 - (0.44 x 0.44 x 0.44) = 0.914816, Impact(S:U) =\n6.42 x 0.914816 = 5.87311872, Exploitability = 8.22 x 0.85 x 0.77 x 0.27 x 0.85\n= 1.234707705, base 7.107826425, taken to 7.2 by the CVSS ceiling-to-tenth\nRoundup - a calculator reporting 7.1 is disagreeing with the rounding rule and\nwith nothing else. AV:N describes the product\u0027s exposure and not our lab\u0027s: the\nchain is three HTTP requests plus one read-back against the product\u0027s single\nlistener, and the loopback binding in our testbed was our own safety choice, not\na product property. AC:L because nothing outside the attacker\u0027s or a normal\ndeployment\u0027s control is needed - ENC_DEBUG is at its shipped value 0\n(`control/options.php:37`), which selects the shell_exec() branch, and the\nlicense-generator path is a setting a functioning installation already has.\n\nPR:H is the metric carrying the weight, and the readings on either side of it\nare printed with their own vectors so the arithmetic is inspectable. Published\nreason: only an installer-provisioned administrator session was demonstrated\nreaching the sink. The product does keep a `guard_staff` table, so a multi-user\ndeployment is possible, but our review found no role or permission column that\nseparates license generation from any other administrator operation and no\ndocumented staff role with a narrower capability set; every path we traced to\n`guardianLicense::create()` sat behind the administrator gate with the same\noperation-level CSRF check. Three alternative readings are therefore labelled and\nrejected rather than hidden:\n\n  - Unauthenticated, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8. Rejected: no\n      unauthenticated path reaches a sink. The remote license-issuing API at\n      `control/api/api-remote.php` is gated by a key randomly generated at\n      install time, which was not bypassed, and the product ships no factory\n      credential because the installer sets the administrator account.\n  - Lower-privileged operator, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8.\n      Rejected: no role-separated principal was demonstrated reaching the\n      generate operation, and the guard_staff role model was not established.\n      Publishing this would rest on an unstudied possibility rather than on a\n      demonstrated principal.\n  - Scope Changed, AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H = 9.1. Rejected: the\n      injected command runs as the same identity, on the same host, inside the\n      same authority the product was granted at install time. No second\n      authorization boundary was crossed and no cross-machine or cross-account\n      outcome was demonstrated, so S:C would rate an outcome the evidence does\n      not contain.\n\nTwo things are deliberately priced at zero in this vector. The remote API key\ncomparison `md5($apiKey) == md5($SETTINGS-\u003eapikey)` is reported as a separate\nhardening weakness - CWE-328 with a CWE-208 aspect, since hashing both sides with\nan unsalted MD5 adds nothing over comparing the raw key and `==` on two digests\nis not a constant-time comparison - and it is folded into nothing. It was not\ndemonstrated to be exploitable, the strength of that gate rests on the entropy\nof the install-time random key, and no leak path for it was found. Likewise the\nsix additional tainted fields on the same sink and the second entry point widen\nthe patch surface a vendor must cover without changing how hard the demonstrated\ninjection is to perform, so they contribute nothing to the score. No correction\nnotice accompanies this figure: our own notes carry no numeric CVSS value for\nthis finding, so 7.2 is derived from the vector above and nothing else.\n\nAuthentication: post-authentication administrator, and the gate held. Every\nadministrator page and every administrator AJAX operation passes through one\ninit-level gate at `admin/control/init.php:122`, which is a hard include-time\ngate rather than a per-request filter that can be forgotten on one route, and the\ngenerate case carries a second operation-level check that the submitted `cs_rf`\nbody field or `csrf` header matches the session-bound `csrf_token`. Eight\ncandidate bypasses were examined and all eight recorded as blocked: forging the\n`guardian_access` session value (it embeds the per-install random SECRET_KEY),\nomitting or replaying the CSRF token (session-bound, validated per operation,\nrotated per page render), injecting the internal `$loginBypass` variable (no\nexternal input reaches it), SQL injection in the login path (the staff lookup is\nparameterised and the constant path compares salted SHA-1 digests), a timing\nattack on that comparison (equal-length hex digests, no exploitable divergence\nidentified), a default-credential fallback (the installer forces the operator to\nset it), hard-coded LG_USER or LG_PASS (written at install time from operator\ninput, not compiled in), and guessing the remote API key (randomly generated at\ninstall). The unauthenticated surface was enumerated interface by interface and\nparameter by parameter: roughly sixty-two interfaces were inventoried by three\nindependent methods that agreed, roughly nine answer without credentials (four\nstatic asset trees, the buyer portal front page and its license-lookup\noperation, the remote API endpoint refusing a keyless request, the\npost-installation installer route, and the login operation itself), and zero of\nthose nine reach a command-execution, deserialization or file-write sink.\nEvery parameter of every unauthenticated interface was tested for traversal,\ninjection, type confusion, over-long input and encoding bypass. Unauthenticated\nremote code execution was not reached and none is claimed.\n\nOne honesty point about the negative control, because the published exploit\ncarries a control mode that was never recorded. The script ships a --control\nmode that repeats the identical authenticated sequence - same login, same fresh\nCSRF token, same generate operation, same field set including a non-empty\nlicpath and a key/value pair - with a benign project identifier and project key,\npoints its read-back at a marker name it never injects, and asserts that the\nmarker URL does not answer. A passing control would rule out that the proof file\npre-existed, that the generate operation writes arbitrary attacker-named files\ninto the document root as a normal side effect, and that the read-back URL is\nserved by something other than the written file. What there is not, and what\nthis post does not pretend otherwise, is an archived control transcript: the\nrecorded verification output is the injection leg, the control leg is shipped so\nthat any reader can execute it against their own instance, and inventing a\ntranscript would be worse than saying so. The structural half of the control\ndoes come from source: the only thing on this path that creates a file inside\nthe document root is the shell command assembled at `class.licensing.php:261`,\nand no branch of the generate operation writes to the content tree on its own.\n\nImpact: arbitrary OS "
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-116",
              "description": "CWE-116",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-20",
              "description": "CWE-20",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-208",
              "description": "CWE-208",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-250",
              "description": "CWE-250",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-328",
              "description": "CWE-328",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-561",
              "description": "CWE-561",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-732",
              "description": "CWE-732",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-78",
              "description": "CWE-78",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-02T07:30:02Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Oct/16"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Oct/16"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/maian-guardian-license-generator-command-injection"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Oct/16"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[0day-rubbish] Maian Guardian 2.1 license generator projid command injection to www-data uid 33 code execution (7.2, PR:H)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0487",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Oct/16",
            "automated": true,
            "contentSha256": "c6f42931cdf5a35451312d596be78de698bb1c4dd482ac4faf3c5de81c35119f",
            "evidenceScore": 11,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Oct/16",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-10-13T02:21:47Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-11-02T07:30:02Z",
    "dateUpdated": "2026-11-02T07:30:02Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0487"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2012-2405 (GCVE-0-2012-2405)

    Vulnerability from nvd – Published: 2012-04-22 18:00 – Updated: 2024-08-06 19:34
    VLAI
    Summary
    Gallery 2 before 2.3.2 and 3 before 3.0.3 does not properly implement encryption, which has unspecified impact and attack vectors, a different vulnerability than CVE-2012-1113.
    Severity
    No CVSS data available.
    CWE
    • n/a
    Assigner
    mitre CNA under the mitre root
    CNA scorecard E 29/100 over 2158 records in the last 180 days details
    References
    Date Public
    2012-04-03 00:00
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T19:34:25.241Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://gallery.menalto.com/gallery_3_0_3_and_gallery_2_3_2"
          },
          {
            "name": "gallery-encryption-unspecified(75201)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/75201"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=812045"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2012-04-03T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Gallery 2 before 2.3.2 and 3 before 3.0.3 does not properly implement encryption, which has unspecified impact and attack vectors, a different vulnerability than CVE-2012-1113."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-12-13T18:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://gallery.menalto.com/gallery_3_0_3_and_gallery_2_3_2"
        },
        {
          "name": "gallery-encryption-unspecified(75201)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/75201"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=812045"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2012-2405",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Gallery 2 before 2.3.2 and 3 before 3.0.3 does not properly implement encryption, which has unspecified impact and attack vectors, a different vulnerability than CVE-2012-1113."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://gallery.menalto.com/gallery_3_0_3_and_gallery_2_3_2",
              "refsource": "CONFIRM",
              "url": "http://gallery.menalto.com/gallery_3_0_3_and_gallery_2_3_2"
            },
            {
              "name": "gallery-encryption-unspecified(75201)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/75201"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=812045",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=812045"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2012-2405",
    "datePublished": "2012-04-22T18:00:00.000Z",
    "dateReserved": "2012-04-22T00:00:00.000Z",
    "dateUpdated": "2024-08-06T19:34:25.241Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2012-1113 (GCVE-0-2012-1113)

    Vulnerability from nvd – Published: 2012-04-22 18:00 – Updated: 2024-08-06 18:45
    VLAI
    Summary
    Multiple cross-site scripting (XSS) vulnerabilities in the administration subsystem in Gallery 2 before 2.3.2 and 3 before 3.0.3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
    Severity
    No CVSS data available.
    CWE
    • n/a
    Assigner
    redhat CNA under the redhat root
    CNA scorecard B 82/100 over 1212 records in the last 180 days details
    References
    Date Public
    2012-04-03 00:00
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T18:45:27.491Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "FEDORA-2012-5814",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078851.html"
          },
          {
            "name": "FEDORA-2012-5832",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078873.html"
          },
          {
            "name": "48767",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/48767"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://gallery.menalto.com/gallery_3_0_3_and_gallery_2_3_2"
          },
          {
            "name": "FEDORA-2012-5777",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078618.html"
          },
          {
            "name": "52996",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/52996"
          },
          {
            "name": "FEDORA-2012-5822",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078925.html"
          },
          {
            "name": "FEDORA-2012-5787",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078752.html"
          },
          {
            "name": "gallery-unspec-xss(74837)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/74837"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=812045"
          },
          {
            "name": "FEDORA-2012-5806",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078816.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2012-04-03T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple cross-site scripting (XSS) vulnerabilities in the administration subsystem in Gallery 2 before 2.3.2 and 3 before 3.0.3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-12-06T21:57:01.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "FEDORA-2012-5814",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078851.html"
        },
        {
          "name": "FEDORA-2012-5832",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078873.html"
        },
        {
          "name": "48767",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/48767"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://gallery.menalto.com/gallery_3_0_3_and_gallery_2_3_2"
        },
        {
          "name": "FEDORA-2012-5777",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078618.html"
        },
        {
          "name": "52996",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/52996"
        },
        {
          "name": "FEDORA-2012-5822",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078925.html"
        },
        {
          "name": "FEDORA-2012-5787",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078752.html"
        },
        {
          "name": "gallery-unspec-xss(74837)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/74837"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=812045"
        },
        {
          "name": "FEDORA-2012-5806",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078816.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2012-1113",
    "datePublished": "2012-04-22T18:00:00.000Z",
    "dateReserved": "2012-02-14T00:00:00.000Z",
    "dateUpdated": "2024-08-06T18:45:27.491Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2008-3319 (GCVE-0-2008-3319)

    Vulnerability from nvd – Published: 2008-07-25 16:00 – Updated: 2024-08-07 09:37
    VLAI
    Summary
    admin/index.php in Maian Links 3.1 and earlier allows remote attackers to bypass authentication and gain administrative access by sending an arbitrary links_cookie cookie.
    Severity
    No CVSS data available.
    CWE
    • n/a
    Assigner
    mitre CNA under the mitre root
    CNA scorecard E 29/100 over 2158 records in the last 180 days details
    References
    URL Tags
    https://www.exploit-db.com/exploits/6062 exploitx_refsource_EXPLOIT-DB
    http://secunia.com/advisories/31068 third-party-advisoryx_refsource_SECUNIA
    http://www.securityfocus.com/bid/30205 vdb-entryx_refsource_BID
    https://exchange.xforce.ibmcloud.com/vulnerabilit… vdb-entryx_refsource_XF
    http://www.maianscriptworld.co.uk/news.html x_refsource_CONFIRM
    http://www.maianscriptworld.co.uk/free-php-script… x_refsource_CONFIRM
    Date Public
    2008-07-12 00:00
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T09:37:26.576Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "6062",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "https://www.exploit-db.com/exploits/6062"
          },
          {
            "name": "31068",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/31068"
          },
          {
            "name": "30205",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/30205"
          },
          {
            "name": "maianlinks-index-security-bypass(43749)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43749"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.maianscriptworld.co.uk/news.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.maianscriptworld.co.uk/free-php-scripts/maian-links/development/index.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2008-07-12T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "admin/index.php in Maian Links 3.1 and earlier allows remote attackers to bypass authentication and gain administrative access by sending an arbitrary links_cookie cookie."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-10-18T14:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "6062",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "https://www.exploit-db.com/exploits/6062"
        },
        {
          "name": "31068",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/31068"
        },
        {
          "name": "30205",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/30205"
        },
        {
          "name": "maianlinks-index-security-bypass(43749)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43749"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.maianscriptworld.co.uk/news.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.maianscriptworld.co.uk/free-php-scripts/maian-links/development/index.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2008-3319",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "admin/index.php in Maian Links 3.1 and earlier allows remote attackers to bypass authentication and gain administrative access by sending an arbitrary links_cookie cookie."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "6062",
              "refsource": "EXPLOIT-DB",
              "url": "https://www.exploit-db.com/exploits/6062"
            },
            {
              "name": "31068",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/31068"
            },
            {
              "name": "30205",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/30205"
            },
            {
              "name": "maianlinks-index-security-bypass(43749)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43749"
            },
            {
              "name": "http://www.maianscriptworld.co.uk/news.html",
              "refsource": "CONFIRM",
              "url": "http://www.maianscriptworld.co.uk/news.html"
            },
            {
              "name": "http://www.maianscriptworld.co.uk/free-php-scripts/maian-links/development/index.html",
              "refsource": "CONFIRM",
              "url": "http://www.maianscriptworld.co.uk/free-php-scripts/maian-links/development/index.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2008-3319",
    "datePublished": "2008-07-25T16:00:00.000Z",
    "dateReserved": "2008-07-25T00:00:00.000Z",
    "dateUpdated": "2024-08-07T09:37:26.576Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2008-3318 (GCVE-0-2008-3318)

    Vulnerability from nvd – Published: 2008-07-25 16:00 – Updated: 2024-08-07 09:37
    VLAI
    Summary
    admin/index.php in Maian Weblog 4.0 and earlier allows remote attackers to bypass authentication and gain administrative access by sending an arbitrary weblog_cookie cookie.
    Severity
    No CVSS data available.
    CWE
    • n/a
    Assigner
    mitre CNA under the mitre root
    CNA scorecard E 29/100 over 2158 records in the last 180 days details
    References
    URL Tags
    http://www.maianscriptworld.co.uk/free-php-script… x_refsource_CONFIRM
    http://www.securityfocus.com/bid/30209 vdb-entryx_refsource_BID
    http://www.maianscriptworld.co.uk/news.html x_refsource_CONFIRM
    https://exchange.xforce.ibmcloud.com/vulnerabilit… vdb-entryx_refsource_XF
    http://secunia.com/advisories/30943 third-party-advisoryx_refsource_SECUNIA
    https://www.exploit-db.com/exploits/6064 exploitx_refsource_EXPLOIT-DB
    Date Public
    2008-07-13 00:00
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T09:37:26.371Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.maianscriptworld.co.uk/free-php-scripts/maian-weblog/development/index.html"
          },
          {
            "name": "30209",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/30209"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.maianscriptworld.co.uk/news.html"
          },
          {
            "name": "maianweblog-index-security-bypass(43751)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43751"
          },
          {
            "name": "30943",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/30943"
          },
          {
            "name": "6064",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "https://www.exploit-db.com/exploits/6064"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2008-07-13T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "admin/index.php in Maian Weblog 4.0 and earlier allows remote attackers to bypass authentication and gain administrative access by sending an arbitrary weblog_cookie cookie."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-10-18T14:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.maianscriptworld.co.uk/free-php-scripts/maian-weblog/development/index.html"
        },
        {
          "name": "30209",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/30209"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.maianscriptworld.co.uk/news.html"
        },
        {
          "name": "maianweblog-index-security-bypass(43751)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43751"
        },
        {
          "name": "30943",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/30943"
        },
        {
          "name": "6064",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "https://www.exploit-db.com/exploits/6064"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2008-3318",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "admin/index.php in Maian Weblog 4.0 and earlier allows remote attackers to bypass authentication and gain administrative access by sending an arbitrary weblog_cookie cookie."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www.maianscriptworld.co.uk/free-php-scripts/maian-weblog/development/index.html",
              "refsource": "CONFIRM",
              "url": "http://www.maianscriptworld.co.uk/free-php-scripts/maian-weblog/development/index.html"
            },
            {
              "name": "30209",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/30209"
            },
            {
              "name": "http://www.maianscriptworld.co.uk/news.html",
              "refsource": "CONFIRM",
              "url": "http://www.maianscriptworld.co.uk/news.html"
            },
            {
              "name": "maianweblog-index-security-bypass(43751)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43751"
            },
            {
              "name": "30943",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/30943"
            },
            {
              "name": "6064",
              "refsource": "EXPLOIT-DB",
              "url": "https://www.exploit-db.com/exploits/6064"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2008-3318",
    "datePublished": "2008-07-25T16:00:00.000Z",
    "dateReserved": "2008-07-25T00:00:00.000Z",
    "dateUpdated": "2024-08-07T09:37:26.371Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2008-3320 (GCVE-0-2008-3320)

    Vulnerability from nvd – Published: 2008-07-25 16:00 – Updated: 2024-08-07 09:37
    VLAI
    Summary
    admin/index.php in Maian Guestbook 3.2 and earlier allows remote attackers to bypass authentication and gain administrative access by sending an arbitrary gbook_cookie cookie.
    Severity
    No CVSS data available.
    CWE
    • n/a
    Assigner
    mitre CNA under the mitre root
    CNA scorecard E 29/100 over 2158 records in the last 180 days details
    References
    URL Tags
    https://www.exploit-db.com/exploits/6061 exploitx_refsource_EXPLOIT-DB
    http://secunia.com/advisories/31070 third-party-advisoryx_refsource_SECUNIA
    http://www.securityfocus.com/bid/30203 vdb-entryx_refsource_BID
    http://www.maianscriptworld.co.uk/free-php-script… x_refsource_CONFIRM
    Date Public
    2008-07-15 00:00
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T09:37:26.880Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "6061",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "https://www.exploit-db.com/exploits/6061"
          },
          {
            "name": "31070",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/31070"
          },
          {
            "name": "30203",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/30203"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.maianscriptworld.co.uk/free-php-scripts/maian-guestbook/development/index.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2008-07-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "admin/index.php in Maian Guestbook 3.2 and earlier allows remote attackers to bypass authentication and gain administrative access by sending an arbitrary gbook_cookie cookie."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-10-18T14:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "6061",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "https://www.exploit-db.com/exploits/6061"
        },
        {
          "name": "31070",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/31070"
        },
        {
          "name": "30203",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/30203"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.maianscriptworld.co.uk/free-php-scripts/maian-guestbook/development/index.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2008-3320",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "admin/index.php in Maian Guestbook 3.2 and earlier allows remote attackers to bypass authentication and gain administrative access by sending an arbitrary gbook_cookie cookie."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "6061",
              "refsource": "EXPLOIT-DB",
              "url": "https://www.exploit-db.com/exploits/6061"
            },
            {
              "name": "31070",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/31070"
            },
            {
              "name": "30203",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/30203"
            },
            {
              "name": "http://www.maianscriptworld.co.uk/free-php-scripts/maian-guestbook/development/index.html",
              "refsource": "CONFIRM",
              "url": "http://www.maianscriptworld.co.uk/free-php-scripts/maian-guestbook/development/index.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2008-3320",
    "datePublished": "2008-07-25T16:00:00.000Z",
    "dateReserved": "2008-07-25T00:00:00.000Z",
    "dateUpdated": "2024-08-07T09:37:26.880Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2008-3322 (GCVE-0-2008-3322)

    Vulnerability from nvd – Published: 2008-07-25 16:00 – Updated: 2024-08-07 09:37
    VLAI
    Summary
    admin/index.php in Maian Recipe 1.2 and earlier allows remote attackers to bypass authentication and gain administrative access by sending an arbitrary recipe_cookie cookie.
    Severity
    No CVSS data available.
    CWE
    • n/a
    Assigner
    mitre CNA under the mitre root
    CNA scorecard E 29/100 over 2158 records in the last 180 days details
    References
    URL Tags
    https://exchange.xforce.ibmcloud.com/vulnerabilit… vdb-entryx_refsource_XF
    http://www.securityfocus.com/bid/30208 vdb-entryx_refsource_BID
    http://www.maianscriptworld.co.uk/news.html x_refsource_CONFIRM
    https://www.exploit-db.com/exploits/6063 exploitx_refsource_EXPLOIT-DB
    http://secunia.com/advisories/31071 third-party-advisoryx_refsource_SECUNIA
    Date Public
    2008-07-13 00:00
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T09:37:26.426Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "maianrecipe-index-security-bypass(43750)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43750"
          },
          {
            "name": "30208",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/30208"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.maianscriptworld.co.uk/news.html"
          },
          {
            "name": "6063",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "https://www.exploit-db.com/exploits/6063"
          },
          {
            "name": "31071",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/31071"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2008-07-13T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "admin/index.php in Maian Recipe 1.2 and earlier allows remote attackers to bypass authentication and gain administrative access by sending an arbitrary recipe_cookie cookie."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-10-18T14:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "maianrecipe-index-security-bypass(43750)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43750"
        },
        {
          "name": "30208",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/30208"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.maianscriptworld.co.uk/news.html"
        },
        {
          "name": "6063",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "https://www.exploit-db.com/exploits/6063"
        },
        {
          "name": "31071",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/31071"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2008-3322",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "admin/index.php in Maian Recipe 1.2 and earlier allows remote attackers to bypass authentication and gain administrative access by sending an arbitrary recipe_cookie cookie."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "maianrecipe-index-security-bypass(43750)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43750"
            },
            {
              "name": "30208",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/30208"
            },
            {
              "name": "http://www.maianscriptworld.co.uk/news.html",
              "refsource": "CONFIRM",
              "url": "http://www.maianscriptworld.co.uk/news.html"
            },
            {
              "name": "6063",
              "refsource": "EXPLOIT-DB",
              "url": "https://www.exploit-db.com/exploits/6063"
            },
            {
              "name": "31071",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/31071"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2008-3322",
    "datePublished": "2008-07-25T16:00:00.000Z",
    "dateReserved": "2008-07-25T00:00:00.000Z",
    "dateUpdated": "2024-08-07T09:37:26.426Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2007-2076 (GCVE-0-2007-2076)

    Vulnerability from nvd – Published: 2007-04-18 02:20 – Updated: 2024-08-07 13:23
    VLAI
    Summary
    PHP remote file inclusion vulnerability in index.php in Maian Gallery 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the path_to_folder parameter. NOTE: this issue was disputed by a third party researcher, but confirmed by the vendor, stating "this problem existed only briefly in v1.0."
    Severity
    No CVSS data available.
    CWE
    • n/a
    Assigner
    mitre CNA under the mitre root
    CNA scorecard E 29/100 over 2158 records in the last 180 days details
    References
    URL Tags
    https://exchange.xforce.ibmcloud.com/vulnerabilit… vdb-entryx_refsource_XF
    http://www.securityfocus.com/archive/1/465853/100… mailing-listx_refsource_BUGTRAQ
    http://archives.neohapsis.com/archives/bugtraq/20… mailing-listx_refsource_BUGTRAQ
    http://attrition.org/pipermail/vim/2007-April/001… mailing-listx_refsource_VIM
    http://www.securityfocus.com/archive/1/465732/100… mailing-listx_refsource_BUGTRAQ
    http://www.osvdb.org/34149 vdb-entryx_refsource_OSVDB
    Date Public
    2007-04-14 00:00
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T13:23:50.360Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "maiangallery-pathtofolder-file-include(33692)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/33692"
          },
          {
            "name": "20070414 Re: Maian Gallery v1.0",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/465853/100/0/threaded"
          },
          {
            "name": "20070415 Re: phpMyChat-0.14.5",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://archives.neohapsis.com/archives/bugtraq/2007-04/0244.html"
          },
          {
            "name": "20070415 false: Maian Gallery v1.0",
            "tags": [
              "mailing-list",
              "x_refsource_VIM",
              "x_transferred"
            ],
            "url": "http://attrition.org/pipermail/vim/2007-April/001530.html"
          },
          {
            "name": "20070414 Maian Gallery v1.0",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/465732/100/0/threaded"
          },
          {
            "name": "34149",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://www.osvdb.org/34149"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2007-04-14T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "PHP remote file inclusion vulnerability in index.php in Maian Gallery 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the path_to_folder parameter.  NOTE: this issue was disputed by a third party researcher, but confirmed by the vendor, stating \"this problem existed only briefly in v1.0.\""
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-16T14:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "maiangallery-pathtofolder-file-include(33692)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/33692"
        },
        {
          "name": "20070414 Re: Maian Gallery v1.0",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/465853/100/0/threaded"
        },
        {
          "name": "20070415 Re: phpMyChat-0.14.5",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://archives.neohapsis.com/archives/bugtraq/2007-04/0244.html"
        },
        {
          "name": "20070415 false: Maian Gallery v1.0",
          "tags": [
            "mailing-list",
            "x_refsource_VIM"
          ],
          "url": "http://attrition.org/pipermail/vim/2007-April/001530.html"
        },
        {
          "name": "20070414 Maian Gallery v1.0",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/465732/100/0/threaded"
        },
        {
          "name": "34149",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://www.osvdb.org/34149"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2007-2076",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "PHP remote file inclusion vulnerability in index.php in Maian Gallery 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the path_to_folder parameter.  NOTE: this issue was disputed by a third party researcher, but confirmed by the vendor, stating \"this problem existed only briefly in v1.0.\""
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "maiangallery-pathtofolder-file-include(33692)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/33692"
            },
            {
              "name": "20070414 Re: Maian Gallery v1.0",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/465853/100/0/threaded"
            },
            {
              "name": "20070415 Re: phpMyChat-0.14.5",
              "refsource": "BUGTRAQ",
              "url": "http://archives.neohapsis.com/archives/bugtraq/2007-04/0244.html"
            },
            {
              "name": "20070415 false: Maian Gallery v1.0",
              "refsource": "VIM",
              "url": "http://attrition.org/pipermail/vim/2007-April/001530.html"
            },
            {
              "name": "20070414 Maian Gallery v1.0",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/465732/100/0/threaded"
            },
            {
              "name": "34149",
              "refsource": "OSVDB",
              "url": "http://www.osvdb.org/34149"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2007-2076",
    "datePublished": "2007-04-18T02:20:00.000Z",
    "dateReserved": "2007-04-17T00:00:00.000Z",
    "dateUpdated": "2024-08-07T13:23:50.360Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2007-2077 (GCVE-0-2007-2077)

    Vulnerability from nvd – Published: 2007-04-18 02:20 – Updated: 2024-08-07 13:23
    VLAI
    Summary
    PHP remote file inclusion vulnerability in search.php in Maian Search 1.1 allows remote attackers to execute arbitrary PHP code via a URL in the path_to_folder parameter. NOTE: this issue was disputed by a third party researcher, but confirmed by the vendor, stating "this issue was fixed last year and [no] is longer a problem."
    Severity
    No CVSS data available.
    CWE
    • n/a
    Assigner
    mitre CNA under the mitre root
    CNA scorecard E 29/100 over 2158 records in the last 180 days details
    References
    URL Tags
    http://www.securityfocus.com/archive/1/465857/100… mailing-listx_refsource_BUGTRAQ
    http://archives.neohapsis.com/archives/bugtraq/20… mailing-listx_refsource_BUGTRAQ
    http://attrition.org/pipermail/vim/2007-April/001… mailing-listx_refsource_VIM
    http://www.osvdb.org/34150 vdb-entryx_refsource_OSVDB
    http://www.securityfocus.com/archive/1/465731/100… mailing-listx_refsource_BUGTRAQ
    Date Public
    2007-04-14 00:00
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T13:23:50.410Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "20070414 Re: Maian Search v1.1",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/465857/100/0/threaded"
          },
          {
            "name": "20070415 Re: phpMyChat-0.14.5",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://archives.neohapsis.com/archives/bugtraq/2007-04/0244.html"
          },
          {
            "name": "20070414 false: Maian Search v1.1",
            "tags": [
              "mailing-list",
              "x_refsource_VIM",
              "x_transferred"
            ],
            "url": "http://attrition.org/pipermail/vim/2007-April/001524.html"
          },
          {
            "name": "34150",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://www.osvdb.org/34150"
          },
          {
            "name": "20070414 Maian Search v1.1",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/465731/100/0/threaded"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2007-04-14T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "PHP remote file inclusion vulnerability in search.php in Maian Search 1.1 allows remote attackers to execute arbitrary PHP code via a URL in the path_to_folder parameter.  NOTE: this issue was disputed by a third party researcher, but confirmed by the vendor, stating \"this issue was fixed last year and [no] is longer a problem.\""
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-16T14:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "20070414 Re: Maian Search v1.1",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/465857/100/0/threaded"
        },
        {
          "name": "20070415 Re: phpMyChat-0.14.5",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://archives.neohapsis.com/archives/bugtraq/2007-04/0244.html"
        },
        {
          "name": "20070414 false: Maian Search v1.1",
          "tags": [
            "mailing-list",
            "x_refsource_VIM"
          ],
          "url": "http://attrition.org/pipermail/vim/2007-April/001524.html"
        },
        {
          "name": "34150",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://www.osvdb.org/34150"
        },
        {
          "name": "20070414 Maian Search v1.1",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/465731/100/0/threaded"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2007-2077",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "PHP remote file inclusion vulnerability in search.php in Maian Search 1.1 allows remote attackers to execute arbitrary PHP code via a URL in the path_to_folder parameter.  NOTE: this issue was disputed by a third party researcher, but confirmed by the vendor, stating \"this issue was fixed last year and [no] is longer a problem.\""
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "20070414 Re: Maian Search v1.1",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/465857/100/0/threaded"
            },
            {
              "name": "20070415 Re: phpMyChat-0.14.5",
              "refsource": "BUGTRAQ",
              "url": "http://archives.neohapsis.com/archives/bugtraq/2007-04/0244.html"
            },
            {
              "name": "20070414 false: Maian Search v1.1",
              "refsource": "VIM",
              "url": "http://attrition.org/pipermail/vim/2007-April/001524.html"
            },
            {
              "name": "34150",
              "refsource": "OSVDB",
              "url": "http://www.osvdb.org/34150"
            },
            {
              "name": "20070414 Maian Search v1.1",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/465731/100/0/threaded"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2007-2077",
    "datePublished": "2007-04-18T02:20:00.000Z",
    "dateReserved": "2007-04-17T00:00:00.000Z",
    "dateUpdated": "2024-08-07T13:23:50.410Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2007-2078 (GCVE-0-2007-2078)

    Vulnerability from nvd – Published: 2007-04-18 02:20 – Updated: 2024-08-07 13:23 Disputed
    VLAI
    Summary
    PHP remote file inclusion vulnerability in index.php in Maian Weblog 3.1 allows remote attackers to execute arbitrary PHP code via a URL in the path_to_folder parameter. NOTE: this issue was disputed by a third party researcher, since the path_to_folder variable is initialized before use
    Severity
    No CVSS data available.
    CWE
    • n/a
    Assigner
    mitre CNA under the mitre root
    CNA scorecard E 29/100 over 2158 records in the last 180 days details
    References
    URL Tags
    http://osvdb.org/35360 vdb-entryx_refsource_OSVDB
    http://securityreason.com/securityalert/2582 third-party-advisoryx_refsource_SREASON
    http://www.securityfocus.com/archive/1/465735/100… mailing-listx_refsource_BUGTRAQ
    http://archives.neohapsis.com/archives/bugtraq/20… mailing-listx_refsource_BUGTRAQ
    https://exchange.xforce.ibmcloud.com/vulnerabilit… vdb-entryx_refsource_XF
    http://attrition.org/pipermail/vim/2007-April/001… mailing-listx_refsource_VIM
    Date Public
    2007-04-14 00:00
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T13:23:50.102Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "35360",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/35360"
          },
          {
            "name": "2582",
            "tags": [
              "third-party-advisory",
              "x_refsource_SREASON",
              "x_transferred"
            ],
            "url": "http://securityreason.com/securityalert/2582"
          },
          {
            "name": "20070414 Maian Weblog v3.1",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/465735/100/0/threaded"
          },
          {
            "name": "20070415 Re: phpMyChat-0.14.5",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://archives.neohapsis.com/archives/bugtraq/2007-04/0244.html"
          },
          {
            "name": "maianweblog-pathtofolder-file-include(33708)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/33708"
          },
          {
            "name": "20070415 false: Maian Weblog v3.1",
            "tags": [
              "mailing-list",
              "x_refsource_VIM",
              "x_transferred"
            ],
            "url": "http://attrition.org/pipermail/vim/2007-April/001527.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2007-04-14T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "PHP remote file inclusion vulnerability in index.php in Maian Weblog 3.1 allows remote attackers to execute arbitrary PHP code via a URL in the path_to_folder parameter.  NOTE: this issue was disputed by a third party researcher, since the path_to_folder variable is initialized before use"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-16T14:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "35360",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/35360"
        },
        {
          "name": "2582",
          "tags": [
            "third-party-advisory",
            "x_refsource_SREASON"
          ],
          "url": "http://securityreason.com/securityalert/2582"
        },
        {
          "name": "20070414 Maian Weblog v3.1",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/465735/100/0/threaded"
        },
        {
          "name": "20070415 Re: phpMyChat-0.14.5",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://archives.neohapsis.com/archives/bugtraq/2007-04/0244.html"
        },
        {
          "name": "maianweblog-pathtofolder-file-include(33708)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/33708"
        },
        {
          "name": "20070415 false: Maian Weblog v3.1",
          "tags": [
            "mailing-list",
            "x_refsource_VIM"
          ],
          "url": "http://attrition.org/pipermail/vim/2007-April/001527.html"
        }
      ],
      "tags": [
        "disputed"
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2007-2078",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "** DISPUTED **  PHP remote file inclusion vulnerability in index.php in Maian Weblog 3.1 allows remote attackers to execute arbitrary PHP code via a URL in the path_to_folder parameter.  NOTE: this issue was disputed by a third party researcher, since the path_to_folder variable is initialized before use."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "35360",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/35360"
            },
            {
              "name": "2582",
              "refsource": "SREASON",
              "url": "http://securityreason.com/securityalert/2582"
            },
            {
              "name": "20070414 Maian Weblog v3.1",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/465735/100/0/threaded"
            },
            {
              "name": "20070415 Re: phpMyChat-0.14.5",
              "refsource": "BUGTRAQ",
              "url": "http://archives.neohapsis.com/archives/bugtraq/2007-04/0244.html"
            },
            {
              "name": "maianweblog-pathtofolder-file-include(33708)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/33708"
            },
            {
              "name": "20070415 false: Maian Weblog v3.1",
              "refsource": "VIM",
              "url": "http://attrition.org/pipermail/vim/2007-April/001527.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2007-2078",
    "datePublished": "2007-04-18T02:20:00.000Z",
    "dateReserved": "2007-04-17T00:00:00.000Z",
    "dateUpdated": "2024-08-07T13:23:50.102Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2006-1259 (GCVE-0-2006-1259)

    Vulnerability from nvd – Published: 2006-03-19 01:00 – Updated: 2024-08-07 17:03
    VLAI
    Summary
    Multiple SQL injection vulnerabilities in Maian Support 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) email or (2) pass parameter to admin/index.php.
    Severity
    No CVSS data available.
    CWE
    • n/a
    Assigner
    mitre CNA under the mitre root
    CNA scorecard E 29/100 over 2158 records in the last 180 days details
    References
    URL Tags
    https://exchange.xforce.ibmcloud.com/vulnerabilit… vdb-entryx_refsource_XF
    http://www.osvdb.org/23944 vdb-entryx_refsource_OSVDB
    http://www.securityfocus.com/archive/1/429098/100… mailing-listx_refsource_BUGTRAQ
    http://securityreason.com/securityalert/645 third-party-advisoryx_refsource_SREASON
    http://evuln.com/vulns/103/summary.html x_refsource_MISC
    http://www.vupen.com/english/advisories/2006/0992 vdb-entryx_refsource_VUPEN
    http://secunia.com/advisories/19275 third-party-advisoryx_refsource_SECUNIA
    Date Public
    2006-03-17 00:00
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T17:03:28.907Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "maiansupport-adminindex-sql-injection(25300)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/25300"
          },
          {
            "name": "23944",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://www.osvdb.org/23944"
          },
          {
            "name": "20060328 [eVuln] Maian Support Authentication Bypass",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/429098/100/0/threaded"
          },
          {
            "name": "645",
            "tags": [
              "third-party-advisory",
              "x_refsource_SREASON",
              "x_transferred"
            ],
            "url": "http://securityreason.com/securityalert/645"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://evuln.com/vulns/103/summary.html"
          },
          {
            "name": "ADV-2006-0992",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2006/0992"
          },
          {
            "name": "19275",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/19275"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2006-03-17T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple SQL injection vulnerabilities in Maian Support 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) email or (2) pass parameter to admin/index.php."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-18T14:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "maiansupport-adminindex-sql-injection(25300)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/25300"
        },
        {
          "name": "23944",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://www.osvdb.org/23944"
        },
        {
          "name": "20060328 [eVuln] Maian Support Authentication Bypass",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/429098/100/0/threaded"
        },
        {
          "name": "645",
          "tags": [
            "third-party-advisory",
            "x_refsource_SREASON"
          ],
          "url": "http://securityreason.com/securityalert/645"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://evuln.com/vulns/103/summary.html"
        },
        {
          "name": "ADV-2006-0992",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2006/0992"
        },
        {
          "name": "19275",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/19275"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2006-1259",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple SQL injection vulnerabilities in Maian Support 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) email or (2) pass parameter to admin/index.php."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "maiansupport-adminindex-sql-injection(25300)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/25300"
            },
            {
              "name": "23944",
              "refsource": "OSVDB",
              "url": "http://www.osvdb.org/23944"
            },
            {
              "name": "20060328 [eVuln] Maian Support Authentication Bypass",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/429098/100/0/threaded"
            },
            {
              "name": "645",
              "refsource": "SREASON",
              "url": "http://securityreason.com/securityalert/645"
            },
            {
              "name": "http://evuln.com/vulns/103/summary.html",
              "refsource": "MISC",
              "url": "http://evuln.com/vulns/103/summary.html"
            },
            {
              "name": "ADV-2006-0992",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2006/0992"
            },
            {
              "name": "19275",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/19275"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2006-1259",
    "datePublished": "2006-03-19T01:00:00.000Z",
    "dateReserved": "2006-03-18T00:00:00.000Z",
    "dateUpdated": "2024-08-07T17:03:28.907Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2012-1113 (GCVE-0-2012-1113)

    Vulnerability from cvelistv5 – Published: 2012-04-22 18:00 – Updated: 2024-08-06 18:45
    VLAI
    Summary
    Multiple cross-site scripting (XSS) vulnerabilities in the administration subsystem in Gallery 2 before 2.3.2 and 3 before 3.0.3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
    Severity
    No CVSS data available.
    CWE
    • n/a
    Assigner
    redhat CNA under the redhat root
    CNA scorecard B 82/100 over 1212 records in the last 180 days details
    References
    Date Public
    2012-04-03 00:00
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T18:45:27.491Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "FEDORA-2012-5814",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078851.html"
          },
          {
            "name": "FEDORA-2012-5832",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078873.html"
          },
          {
            "name": "48767",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/48767"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://gallery.menalto.com/gallery_3_0_3_and_gallery_2_3_2"
          },
          {
            "name": "FEDORA-2012-5777",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078618.html"
          },
          {
            "name": "52996",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/52996"
          },
          {
            "name": "FEDORA-2012-5822",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078925.html"
          },
          {
            "name": "FEDORA-2012-5787",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078752.html"
          },
          {
            "name": "gallery-unspec-xss(74837)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/74837"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=812045"
          },
          {
            "name": "FEDORA-2012-5806",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078816.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2012-04-03T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple cross-site scripting (XSS) vulnerabilities in the administration subsystem in Gallery 2 before 2.3.2 and 3 before 3.0.3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-12-06T21:57:01.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "FEDORA-2012-5814",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078851.html"
        },
        {
          "name": "FEDORA-2012-5832",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078873.html"
        },
        {
          "name": "48767",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/48767"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://gallery.menalto.com/gallery_3_0_3_and_gallery_2_3_2"
        },
        {
          "name": "FEDORA-2012-5777",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078618.html"
        },
        {
          "name": "52996",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/52996"
        },
        {
          "name": "FEDORA-2012-5822",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078925.html"
        },
        {
          "name": "FEDORA-2012-5787",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078752.html"
        },
        {
          "name": "gallery-unspec-xss(74837)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/74837"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=812045"
        },
        {
          "name": "FEDORA-2012-5806",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078816.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2012-1113",
    "datePublished": "2012-04-22T18:00:00.000Z",
    "dateReserved": "2012-02-14T00:00:00.000Z",
    "dateUpdated": "2024-08-06T18:45:27.491Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2012-2405 (GCVE-0-2012-2405)

    Vulnerability from cvelistv5 – Published: 2012-04-22 18:00 – Updated: 2024-08-06 19:34
    VLAI
    Summary
    Gallery 2 before 2.3.2 and 3 before 3.0.3 does not properly implement encryption, which has unspecified impact and attack vectors, a different vulnerability than CVE-2012-1113.
    Severity
    No CVSS data available.
    CWE
    • n/a
    Assigner
    mitre CNA under the mitre root
    CNA scorecard E 29/100 over 2158 records in the last 180 days details
    References
    Date Public
    2012-04-03 00:00
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T19:34:25.241Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://gallery.menalto.com/gallery_3_0_3_and_gallery_2_3_2"
          },
          {
            "name": "gallery-encryption-unspecified(75201)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/75201"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=812045"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2012-04-03T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Gallery 2 before 2.3.2 and 3 before 3.0.3 does not properly implement encryption, which has unspecified impact and attack vectors, a different vulnerability than CVE-2012-1113."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-12-13T18:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://gallery.menalto.com/gallery_3_0_3_and_gallery_2_3_2"
        },
        {
          "name": "gallery-encryption-unspecified(75201)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/75201"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=812045"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2012-2405",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Gallery 2 before 2.3.2 and 3 before 3.0.3 does not properly implement encryption, which has unspecified impact and attack vectors, a different vulnerability than CVE-2012-1113."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://gallery.menalto.com/gallery_3_0_3_and_gallery_2_3_2",
              "refsource": "CONFIRM",
              "url": "http://gallery.menalto.com/gallery_3_0_3_and_gallery_2_3_2"
            },
            {
              "name": "gallery-encryption-unspecified(75201)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/75201"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=812045",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=812045"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2012-2405",
    "datePublished": "2012-04-22T18:00:00.000Z",
    "dateReserved": "2012-04-22T00:00:00.000Z",
    "dateUpdated": "2024-08-06T19:34:25.241Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2008-3319 (GCVE-0-2008-3319)

    Vulnerability from cvelistv5 – Published: 2008-07-25 16:00 – Updated: 2024-08-07 09:37
    VLAI
    Summary
    admin/index.php in Maian Links 3.1 and earlier allows remote attackers to bypass authentication and gain administrative access by sending an arbitrary links_cookie cookie.
    Severity
    No CVSS data available.
    CWE
    • n/a
    Assigner
    mitre CNA under the mitre root
    CNA scorecard E 29/100 over 2158 records in the last 180 days details
    References
    URL Tags
    https://www.exploit-db.com/exploits/6062 exploitx_refsource_EXPLOIT-DB
    http://secunia.com/advisories/31068 third-party-advisoryx_refsource_SECUNIA
    http://www.securityfocus.com/bid/30205 vdb-entryx_refsource_BID
    https://exchange.xforce.ibmcloud.com/vulnerabilit… vdb-entryx_refsource_XF
    http://www.maianscriptworld.co.uk/news.html x_refsource_CONFIRM
    http://www.maianscriptworld.co.uk/free-php-script… x_refsource_CONFIRM
    Date Public
    2008-07-12 00:00
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T09:37:26.576Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "6062",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "https://www.exploit-db.com/exploits/6062"
          },
          {
            "name": "31068",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/31068"
          },
          {
            "name": "30205",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/30205"
          },
          {
            "name": "maianlinks-index-security-bypass(43749)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43749"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.maianscriptworld.co.uk/news.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.maianscriptworld.co.uk/free-php-scripts/maian-links/development/index.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2008-07-12T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "admin/index.php in Maian Links 3.1 and earlier allows remote attackers to bypass authentication and gain administrative access by sending an arbitrary links_cookie cookie."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-10-18T14:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "6062",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "https://www.exploit-db.com/exploits/6062"
        },
        {
          "name": "31068",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/31068"
        },
        {
          "name": "30205",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/30205"
        },
        {
          "name": "maianlinks-index-security-bypass(43749)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43749"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.maianscriptworld.co.uk/news.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.maianscriptworld.co.uk/free-php-scripts/maian-links/development/index.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2008-3319",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "admin/index.php in Maian Links 3.1 and earlier allows remote attackers to bypass authentication and gain administrative access by sending an arbitrary links_cookie cookie."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "6062",
              "refsource": "EXPLOIT-DB",
              "url": "https://www.exploit-db.com/exploits/6062"
            },
            {
              "name": "31068",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/31068"
            },
            {
              "name": "30205",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/30205"
            },
            {
              "name": "maianlinks-index-security-bypass(43749)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43749"
            },
            {
              "name": "http://www.maianscriptworld.co.uk/news.html",
              "refsource": "CONFIRM",
              "url": "http://www.maianscriptworld.co.uk/news.html"
            },
            {
              "name": "http://www.maianscriptworld.co.uk/free-php-scripts/maian-links/development/index.html",
              "refsource": "CONFIRM",
              "url": "http://www.maianscriptworld.co.uk/free-php-scripts/maian-links/development/index.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2008-3319",
    "datePublished": "2008-07-25T16:00:00.000Z",
    "dateReserved": "2008-07-25T00:00:00.000Z",
    "dateUpdated": "2024-08-07T09:37:26.576Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2008-3318 (GCVE-0-2008-3318)

    Vulnerability from cvelistv5 – Published: 2008-07-25 16:00 – Updated: 2024-08-07 09:37
    VLAI
    Summary
    admin/index.php in Maian Weblog 4.0 and earlier allows remote attackers to bypass authentication and gain administrative access by sending an arbitrary weblog_cookie cookie.
    Severity
    No CVSS data available.
    CWE
    • n/a
    Assigner
    mitre CNA under the mitre root
    CNA scorecard E 29/100 over 2158 records in the last 180 days details
    References
    URL Tags
    http://www.maianscriptworld.co.uk/free-php-script… x_refsource_CONFIRM
    http://www.securityfocus.com/bid/30209 vdb-entryx_refsource_BID
    http://www.maianscriptworld.co.uk/news.html x_refsource_CONFIRM
    https://exchange.xforce.ibmcloud.com/vulnerabilit… vdb-entryx_refsource_XF
    http://secunia.com/advisories/30943 third-party-advisoryx_refsource_SECUNIA
    https://www.exploit-db.com/exploits/6064 exploitx_refsource_EXPLOIT-DB
    Date Public
    2008-07-13 00:00
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T09:37:26.371Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.maianscriptworld.co.uk/free-php-scripts/maian-weblog/development/index.html"
          },
          {
            "name": "30209",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/30209"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.maianscriptworld.co.uk/news.html"
          },
          {
            "name": "maianweblog-index-security-bypass(43751)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43751"
          },
          {
            "name": "30943",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/30943"
          },
          {
            "name": "6064",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "https://www.exploit-db.com/exploits/6064"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2008-07-13T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "admin/index.php in Maian Weblog 4.0 and earlier allows remote attackers to bypass authentication and gain administrative access by sending an arbitrary weblog_cookie cookie."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-10-18T14:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.maianscriptworld.co.uk/free-php-scripts/maian-weblog/development/index.html"
        },
        {
          "name": "30209",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/30209"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.maianscriptworld.co.uk/news.html"
        },
        {
          "name": "maianweblog-index-security-bypass(43751)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43751"
        },
        {
          "name": "30943",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/30943"
        },
        {
          "name": "6064",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "https://www.exploit-db.com/exploits/6064"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2008-3318",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "admin/index.php in Maian Weblog 4.0 and earlier allows remote attackers to bypass authentication and gain administrative access by sending an arbitrary weblog_cookie cookie."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www.maianscriptworld.co.uk/free-php-scripts/maian-weblog/development/index.html",
              "refsource": "CONFIRM",
              "url": "http://www.maianscriptworld.co.uk/free-php-scripts/maian-weblog/development/index.html"
            },
            {
              "name": "30209",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/30209"
            },
            {
              "name": "http://www.maianscriptworld.co.uk/news.html",
              "refsource": "CONFIRM",
              "url": "http://www.maianscriptworld.co.uk/news.html"
            },
            {
              "name": "maianweblog-index-security-bypass(43751)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43751"
            },
            {
              "name": "30943",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/30943"
            },
            {
              "name": "6064",
              "refsource": "EXPLOIT-DB",
              "url": "https://www.exploit-db.com/exploits/6064"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2008-3318",
    "datePublished": "2008-07-25T16:00:00.000Z",
    "dateReserved": "2008-07-25T00:00:00.000Z",
    "dateUpdated": "2024-08-07T09:37:26.371Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2008-3320 (GCVE-0-2008-3320)

    Vulnerability from cvelistv5 – Published: 2008-07-25 16:00 – Updated: 2024-08-07 09:37
    VLAI
    Summary
    admin/index.php in Maian Guestbook 3.2 and earlier allows remote attackers to bypass authentication and gain administrative access by sending an arbitrary gbook_cookie cookie.
    Severity
    No CVSS data available.
    CWE
    • n/a
    Assigner
    mitre CNA under the mitre root
    CNA scorecard E 29/100 over 2158 records in the last 180 days details
    References
    URL Tags
    https://www.exploit-db.com/exploits/6061 exploitx_refsource_EXPLOIT-DB
    http://secunia.com/advisories/31070 third-party-advisoryx_refsource_SECUNIA
    http://www.securityfocus.com/bid/30203 vdb-entryx_refsource_BID
    http://www.maianscriptworld.co.uk/free-php-script… x_refsource_CONFIRM
    Date Public
    2008-07-15 00:00
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T09:37:26.880Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "6061",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "https://www.exploit-db.com/exploits/6061"
          },
          {
            "name": "31070",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/31070"
          },
          {
            "name": "30203",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/30203"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.maianscriptworld.co.uk/free-php-scripts/maian-guestbook/development/index.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2008-07-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "admin/index.php in Maian Guestbook 3.2 and earlier allows remote attackers to bypass authentication and gain administrative access by sending an arbitrary gbook_cookie cookie."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-10-18T14:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "6061",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "https://www.exploit-db.com/exploits/6061"
        },
        {
          "name": "31070",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/31070"
        },
        {
          "name": "30203",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/30203"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.maianscriptworld.co.uk/free-php-scripts/maian-guestbook/development/index.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2008-3320",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "admin/index.php in Maian Guestbook 3.2 and earlier allows remote attackers to bypass authentication and gain administrative access by sending an arbitrary gbook_cookie cookie."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "6061",
              "refsource": "EXPLOIT-DB",
              "url": "https://www.exploit-db.com/exploits/6061"
            },
            {
              "name": "31070",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/31070"
            },
            {
              "name": "30203",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/30203"
            },
            {
              "name": "http://www.maianscriptworld.co.uk/free-php-scripts/maian-guestbook/development/index.html",
              "refsource": "CONFIRM",
              "url": "http://www.maianscriptworld.co.uk/free-php-scripts/maian-guestbook/development/index.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2008-3320",
    "datePublished": "2008-07-25T16:00:00.000Z",
    "dateReserved": "2008-07-25T00:00:00.000Z",
    "dateUpdated": "2024-08-07T09:37:26.880Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2008-3322 (GCVE-0-2008-3322)

    Vulnerability from cvelistv5 – Published: 2008-07-25 16:00 – Updated: 2024-08-07 09:37
    VLAI
    Summary
    admin/index.php in Maian Recipe 1.2 and earlier allows remote attackers to bypass authentication and gain administrative access by sending an arbitrary recipe_cookie cookie.
    Severity
    No CVSS data available.
    CWE
    • n/a
    Assigner
    mitre CNA under the mitre root
    CNA scorecard E 29/100 over 2158 records in the last 180 days details
    References
    URL Tags
    https://exchange.xforce.ibmcloud.com/vulnerabilit… vdb-entryx_refsource_XF
    http://www.securityfocus.com/bid/30208 vdb-entryx_refsource_BID
    http://www.maianscriptworld.co.uk/news.html x_refsource_CONFIRM
    https://www.exploit-db.com/exploits/6063 exploitx_refsource_EXPLOIT-DB
    http://secunia.com/advisories/31071 third-party-advisoryx_refsource_SECUNIA
    Date Public
    2008-07-13 00:00
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T09:37:26.426Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "maianrecipe-index-security-bypass(43750)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43750"
          },
          {
            "name": "30208",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/30208"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.maianscriptworld.co.uk/news.html"
          },
          {
            "name": "6063",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "https://www.exploit-db.com/exploits/6063"
          },
          {
            "name": "31071",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/31071"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2008-07-13T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "admin/index.php in Maian Recipe 1.2 and earlier allows remote attackers to bypass authentication and gain administrative access by sending an arbitrary recipe_cookie cookie."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-10-18T14:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "maianrecipe-index-security-bypass(43750)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43750"
        },
        {
          "name": "30208",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/30208"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.maianscriptworld.co.uk/news.html"
        },
        {
          "name": "6063",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "https://www.exploit-db.com/exploits/6063"
        },
        {
          "name": "31071",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/31071"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2008-3322",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "admin/index.php in Maian Recipe 1.2 and earlier allows remote attackers to bypass authentication and gain administrative access by sending an arbitrary recipe_cookie cookie."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "maianrecipe-index-security-bypass(43750)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43750"
            },
            {
              "name": "30208",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/30208"
            },
            {
              "name": "http://www.maianscriptworld.co.uk/news.html",
              "refsource": "CONFIRM",
              "url": "http://www.maianscriptworld.co.uk/news.html"
            },
            {
              "name": "6063",
              "refsource": "EXPLOIT-DB",
              "url": "https://www.exploit-db.com/exploits/6063"
            },
            {
              "name": "31071",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/31071"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2008-3322",
    "datePublished": "2008-07-25T16:00:00.000Z",
    "dateReserved": "2008-07-25T00:00:00.000Z",
    "dateUpdated": "2024-08-07T09:37:26.426Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2007-2076 (GCVE-0-2007-2076)

    Vulnerability from cvelistv5 – Published: 2007-04-18 02:20 – Updated: 2024-08-07 13:23
    VLAI
    Summary
    PHP remote file inclusion vulnerability in index.php in Maian Gallery 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the path_to_folder parameter. NOTE: this issue was disputed by a third party researcher, but confirmed by the vendor, stating "this problem existed only briefly in v1.0."
    Severity
    No CVSS data available.
    CWE
    • n/a
    Assigner
    mitre CNA under the mitre root
    CNA scorecard E 29/100 over 2158 records in the last 180 days details
    References
    URL Tags
    https://exchange.xforce.ibmcloud.com/vulnerabilit… vdb-entryx_refsource_XF
    http://www.securityfocus.com/archive/1/465853/100… mailing-listx_refsource_BUGTRAQ
    http://archives.neohapsis.com/archives/bugtraq/20… mailing-listx_refsource_BUGTRAQ
    http://attrition.org/pipermail/vim/2007-April/001… mailing-listx_refsource_VIM
    http://www.securityfocus.com/archive/1/465732/100… mailing-listx_refsource_BUGTRAQ
    http://www.osvdb.org/34149 vdb-entryx_refsource_OSVDB
    Date Public
    2007-04-14 00:00
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T13:23:50.360Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "maiangallery-pathtofolder-file-include(33692)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/33692"
          },
          {
            "name": "20070414 Re: Maian Gallery v1.0",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/465853/100/0/threaded"
          },
          {
            "name": "20070415 Re: phpMyChat-0.14.5",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://archives.neohapsis.com/archives/bugtraq/2007-04/0244.html"
          },
          {
            "name": "20070415 false: Maian Gallery v1.0",
            "tags": [
              "mailing-list",
              "x_refsource_VIM",
              "x_transferred"
            ],
            "url": "http://attrition.org/pipermail/vim/2007-April/001530.html"
          },
          {
            "name": "20070414 Maian Gallery v1.0",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/465732/100/0/threaded"
          },
          {
            "name": "34149",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://www.osvdb.org/34149"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2007-04-14T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "PHP remote file inclusion vulnerability in index.php in Maian Gallery 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the path_to_folder parameter.  NOTE: this issue was disputed by a third party researcher, but confirmed by the vendor, stating \"this problem existed only briefly in v1.0.\""
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-16T14:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "maiangallery-pathtofolder-file-include(33692)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/33692"
        },
        {
          "name": "20070414 Re: Maian Gallery v1.0",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/465853/100/0/threaded"
        },
        {
          "name": "20070415 Re: phpMyChat-0.14.5",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://archives.neohapsis.com/archives/bugtraq/2007-04/0244.html"
        },
        {
          "name": "20070415 false: Maian Gallery v1.0",
          "tags": [
            "mailing-list",
            "x_refsource_VIM"
          ],
          "url": "http://attrition.org/pipermail/vim/2007-April/001530.html"
        },
        {
          "name": "20070414 Maian Gallery v1.0",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/465732/100/0/threaded"
        },
        {
          "name": "34149",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://www.osvdb.org/34149"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2007-2076",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "PHP remote file inclusion vulnerability in index.php in Maian Gallery 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the path_to_folder parameter.  NOTE: this issue was disputed by a third party researcher, but confirmed by the vendor, stating \"this problem existed only briefly in v1.0.\""
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "maiangallery-pathtofolder-file-include(33692)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/33692"
            },
            {
              "name": "20070414 Re: Maian Gallery v1.0",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/465853/100/0/threaded"
            },
            {
              "name": "20070415 Re: phpMyChat-0.14.5",
              "refsource": "BUGTRAQ",
              "url": "http://archives.neohapsis.com/archives/bugtraq/2007-04/0244.html"
            },
            {
              "name": "20070415 false: Maian Gallery v1.0",
              "refsource": "VIM",
              "url": "http://attrition.org/pipermail/vim/2007-April/001530.html"
            },
            {
              "name": "20070414 Maian Gallery v1.0",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/465732/100/0/threaded"
            },
            {
              "name": "34149",
              "refsource": "OSVDB",
              "url": "http://www.osvdb.org/34149"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2007-2076",
    "datePublished": "2007-04-18T02:20:00.000Z",
    "dateReserved": "2007-04-17T00:00:00.000Z",
    "dateUpdated": "2024-08-07T13:23:50.360Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2007-2077 (GCVE-0-2007-2077)

    Vulnerability from cvelistv5 – Published: 2007-04-18 02:20 – Updated: 2024-08-07 13:23
    VLAI
    Summary
    PHP remote file inclusion vulnerability in search.php in Maian Search 1.1 allows remote attackers to execute arbitrary PHP code via a URL in the path_to_folder parameter. NOTE: this issue was disputed by a third party researcher, but confirmed by the vendor, stating "this issue was fixed last year and [no] is longer a problem."
    Severity
    No CVSS data available.
    CWE
    • n/a
    Assigner
    mitre CNA under the mitre root
    CNA scorecard E 29/100 over 2158 records in the last 180 days details
    References
    URL Tags
    http://www.securityfocus.com/archive/1/465857/100… mailing-listx_refsource_BUGTRAQ
    http://archives.neohapsis.com/archives/bugtraq/20… mailing-listx_refsource_BUGTRAQ
    http://attrition.org/pipermail/vim/2007-April/001… mailing-listx_refsource_VIM
    http://www.osvdb.org/34150 vdb-entryx_refsource_OSVDB
    http://www.securityfocus.com/archive/1/465731/100… mailing-listx_refsource_BUGTRAQ
    Date Public
    2007-04-14 00:00
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T13:23:50.410Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "20070414 Re: Maian Search v1.1",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/465857/100/0/threaded"
          },
          {
            "name": "20070415 Re: phpMyChat-0.14.5",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://archives.neohapsis.com/archives/bugtraq/2007-04/0244.html"
          },
          {
            "name": "20070414 false: Maian Search v1.1",
            "tags": [
              "mailing-list",
              "x_refsource_VIM",
              "x_transferred"
            ],
            "url": "http://attrition.org/pipermail/vim/2007-April/001524.html"
          },
          {
            "name": "34150",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://www.osvdb.org/34150"
          },
          {
            "name": "20070414 Maian Search v1.1",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/465731/100/0/threaded"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2007-04-14T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "PHP remote file inclusion vulnerability in search.php in Maian Search 1.1 allows remote attackers to execute arbitrary PHP code via a URL in the path_to_folder parameter.  NOTE: this issue was disputed by a third party researcher, but confirmed by the vendor, stating \"this issue was fixed last year and [no] is longer a problem.\""
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-16T14:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "20070414 Re: Maian Search v1.1",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/465857/100/0/threaded"
        },
        {
          "name": "20070415 Re: phpMyChat-0.14.5",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://archives.neohapsis.com/archives/bugtraq/2007-04/0244.html"
        },
        {
          "name": "20070414 false: Maian Search v1.1",
          "tags": [
            "mailing-list",
            "x_refsource_VIM"
          ],
          "url": "http://attrition.org/pipermail/vim/2007-April/001524.html"
        },
        {
          "name": "34150",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://www.osvdb.org/34150"
        },
        {
          "name": "20070414 Maian Search v1.1",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/465731/100/0/threaded"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2007-2077",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "PHP remote file inclusion vulnerability in search.php in Maian Search 1.1 allows remote attackers to execute arbitrary PHP code via a URL in the path_to_folder parameter.  NOTE: this issue was disputed by a third party researcher, but confirmed by the vendor, stating \"this issue was fixed last year and [no] is longer a problem.\""
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "20070414 Re: Maian Search v1.1",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/465857/100/0/threaded"
            },
            {
              "name": "20070415 Re: phpMyChat-0.14.5",
              "refsource": "BUGTRAQ",
              "url": "http://archives.neohapsis.com/archives/bugtraq/2007-04/0244.html"
            },
            {
              "name": "20070414 false: Maian Search v1.1",
              "refsource": "VIM",
              "url": "http://attrition.org/pipermail/vim/2007-April/001524.html"
            },
            {
              "name": "34150",
              "refsource": "OSVDB",
              "url": "http://www.osvdb.org/34150"
            },
            {
              "name": "20070414 Maian Search v1.1",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/465731/100/0/threaded"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2007-2077",
    "datePublished": "2007-04-18T02:20:00.000Z",
    "dateReserved": "2007-04-17T00:00:00.000Z",
    "dateUpdated": "2024-08-07T13:23:50.410Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2007-2078 (GCVE-0-2007-2078)

    Vulnerability from cvelistv5 – Published: 2007-04-18 02:20 – Updated: 2024-08-07 13:23 Disputed
    VLAI
    Summary
    PHP remote file inclusion vulnerability in index.php in Maian Weblog 3.1 allows remote attackers to execute arbitrary PHP code via a URL in the path_to_folder parameter. NOTE: this issue was disputed by a third party researcher, since the path_to_folder variable is initialized before use
    Severity
    No CVSS data available.
    CWE
    • n/a
    Assigner
    mitre CNA under the mitre root
    CNA scorecard E 29/100 over 2158 records in the last 180 days details
    References
    URL Tags
    http://osvdb.org/35360 vdb-entryx_refsource_OSVDB
    http://securityreason.com/securityalert/2582 third-party-advisoryx_refsource_SREASON
    http://www.securityfocus.com/archive/1/465735/100… mailing-listx_refsource_BUGTRAQ
    http://archives.neohapsis.com/archives/bugtraq/20… mailing-listx_refsource_BUGTRAQ
    https://exchange.xforce.ibmcloud.com/vulnerabilit… vdb-entryx_refsource_XF
    http://attrition.org/pipermail/vim/2007-April/001… mailing-listx_refsource_VIM
    Date Public
    2007-04-14 00:00
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T13:23:50.102Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "35360",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/35360"
          },
          {
            "name": "2582",
            "tags": [
              "third-party-advisory",
              "x_refsource_SREASON",
              "x_transferred"
            ],
            "url": "http://securityreason.com/securityalert/2582"
          },
          {
            "name": "20070414 Maian Weblog v3.1",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/465735/100/0/threaded"
          },
          {
            "name": "20070415 Re: phpMyChat-0.14.5",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://archives.neohapsis.com/archives/bugtraq/2007-04/0244.html"
          },
          {
            "name": "maianweblog-pathtofolder-file-include(33708)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/33708"
          },
          {
            "name": "20070415 false: Maian Weblog v3.1",
            "tags": [
              "mailing-list",
              "x_refsource_VIM",
              "x_transferred"
            ],
            "url": "http://attrition.org/pipermail/vim/2007-April/001527.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2007-04-14T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "PHP remote file inclusion vulnerability in index.php in Maian Weblog 3.1 allows remote attackers to execute arbitrary PHP code via a URL in the path_to_folder parameter.  NOTE: this issue was disputed by a third party researcher, since the path_to_folder variable is initialized before use"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-16T14:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "35360",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/35360"
        },
        {
          "name": "2582",
          "tags": [
            "third-party-advisory",
            "x_refsource_SREASON"
          ],
          "url": "http://securityreason.com/securityalert/2582"
        },
        {
          "name": "20070414 Maian Weblog v3.1",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/465735/100/0/threaded"
        },
        {
          "name": "20070415 Re: phpMyChat-0.14.5",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://archives.neohapsis.com/archives/bugtraq/2007-04/0244.html"
        },
        {
          "name": "maianweblog-pathtofolder-file-include(33708)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/33708"
        },
        {
          "name": "20070415 false: Maian Weblog v3.1",
          "tags": [
            "mailing-list",
            "x_refsource_VIM"
          ],
          "url": "http://attrition.org/pipermail/vim/2007-April/001527.html"
        }
      ],
      "tags": [
        "disputed"
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2007-2078",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "** DISPUTED **  PHP remote file inclusion vulnerability in index.php in Maian Weblog 3.1 allows remote attackers to execute arbitrary PHP code via a URL in the path_to_folder parameter.  NOTE: this issue was disputed by a third party researcher, since the path_to_folder variable is initialized before use."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "35360",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/35360"
            },
            {
              "name": "2582",
              "refsource": "SREASON",
              "url": "http://securityreason.com/securityalert/2582"
            },
            {
              "name": "20070414 Maian Weblog v3.1",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/465735/100/0/threaded"
            },
            {
              "name": "20070415 Re: phpMyChat-0.14.5",
              "refsource": "BUGTRAQ",
              "url": "http://archives.neohapsis.com/archives/bugtraq/2007-04/0244.html"
            },
            {
              "name": "maianweblog-pathtofolder-file-include(33708)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/33708"
            },
            {
              "name": "20070415 false: Maian Weblog v3.1",
              "refsource": "VIM",
              "url": "http://attrition.org/pipermail/vim/2007-April/001527.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2007-2078",
    "datePublished": "2007-04-18T02:20:00.000Z",
    "dateReserved": "2007-04-17T00:00:00.000Z",
    "dateUpdated": "2024-08-07T13:23:50.102Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2006-1259 (GCVE-0-2006-1259)

    Vulnerability from cvelistv5 – Published: 2006-03-19 01:00 – Updated: 2024-08-07 17:03
    VLAI
    Summary
    Multiple SQL injection vulnerabilities in Maian Support 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) email or (2) pass parameter to admin/index.php.
    Severity
    No CVSS data available.
    CWE
    • n/a
    Assigner
    mitre CNA under the mitre root
    CNA scorecard E 29/100 over 2158 records in the last 180 days details
    References
    URL Tags
    https://exchange.xforce.ibmcloud.com/vulnerabilit… vdb-entryx_refsource_XF
    http://www.osvdb.org/23944 vdb-entryx_refsource_OSVDB
    http://www.securityfocus.com/archive/1/429098/100… mailing-listx_refsource_BUGTRAQ
    http://securityreason.com/securityalert/645 third-party-advisoryx_refsource_SREASON
    http://evuln.com/vulns/103/summary.html x_refsource_MISC
    http://www.vupen.com/english/advisories/2006/0992 vdb-entryx_refsource_VUPEN
    http://secunia.com/advisories/19275 third-party-advisoryx_refsource_SECUNIA
    Date Public
    2006-03-17 00:00
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T17:03:28.907Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "maiansupport-adminindex-sql-injection(25300)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/25300"
          },
          {
            "name": "23944",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://www.osvdb.org/23944"
          },
          {
            "name": "20060328 [eVuln] Maian Support Authentication Bypass",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/429098/100/0/threaded"
          },
          {
            "name": "645",
            "tags": [
              "third-party-advisory",
              "x_refsource_SREASON",
              "x_transferred"
            ],
            "url": "http://securityreason.com/securityalert/645"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://evuln.com/vulns/103/summary.html"
          },
          {
            "name": "ADV-2006-0992",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2006/0992"
          },
          {
            "name": "19275",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/19275"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2006-03-17T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple SQL injection vulnerabilities in Maian Support 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) email or (2) pass parameter to admin/index.php."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-18T14:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "maiansupport-adminindex-sql-injection(25300)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/25300"
        },
        {
          "name": "23944",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://www.osvdb.org/23944"
        },
        {
          "name": "20060328 [eVuln] Maian Support Authentication Bypass",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/429098/100/0/threaded"
        },
        {
          "name": "645",
          "tags": [
            "third-party-advisory",
            "x_refsource_SREASON"
          ],
          "url": "http://securityreason.com/securityalert/645"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://evuln.com/vulns/103/summary.html"
        },
        {
          "name": "ADV-2006-0992",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2006/0992"
        },
        {
          "name": "19275",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/19275"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2006-1259",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple SQL injection vulnerabilities in Maian Support 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) email or (2) pass parameter to admin/index.php."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "maiansupport-adminindex-sql-injection(25300)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/25300"
            },
            {
              "name": "23944",
              "refsource": "OSVDB",
              "url": "http://www.osvdb.org/23944"
            },
            {
              "name": "20060328 [eVuln] Maian Support Authentication Bypass",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/429098/100/0/threaded"
            },
            {
              "name": "645",
              "refsource": "SREASON",
              "url": "http://securityreason.com/securityalert/645"
            },
            {
              "name": "http://evuln.com/vulns/103/summary.html",
              "refsource": "MISC",
              "url": "http://evuln.com/vulns/103/summary.html"
            },
            {
              "name": "ADV-2006-0992",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2006/0992"
            },
            {
              "name": "19275",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/19275"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2006-1259",
    "datePublished": "2006-03-19T01:00:00.000Z",
    "dateReserved": "2006-03-18T00:00:00.000Z",
    "dateUpdated": "2024-08-07T17:03:28.907Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}