CVE-2012-2438: Undefined Security Weakness

ar web content manager AWCM 2.2 does not restrict the number of comment records that can be submitted through HTTP requests, which allows remote attackers to cause a denial of service disk consumption via the coment parameter to 1 showvideo.php or 2 topic.php...

PT-2012-4044

Name of the Vulnerable Software and Affected Versions ar web content manager AWCM version 2.2 Description The issue allows remote attackers to cause a denial of service due to disk consumption. This can be achieved by submitting a large number of comment records through HTTP requests to specific...

CVE-2010-4810: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in AR Web Content Manager AWCM 2.1 final allow remote attackers to execute arbitrary PHP code via a URL in the themefile parameter to 1 includes/windowtop.php and 2 header.php, and the 3 langfile parameter to control/common.php...

PT-2011-1756

Name of the Vulnerable Software and Affected Versions AR Web Content Manager AWCM version 2.1 final Description The issue allows remote attackers to execute arbitrary PHP code. This can be achieved by providing a URL in the theme file parameter to specific PHP files, such as includes/window top.p...

PT-2011-2748

Name of the Vulnerable Software and Affected Versions AR Web Content Manager AWCM version 2.2 Description The issue allows remote attackers to read arbitrary files and possibly have other unspecified impact. This is achieved by exploiting directory traversal vulnerabilities using a .. dot dot in...

CVE-2011-0903: Improper Limitation of a Pathname to a Restricted Directory

Multiple directory traversal vulnerabilities in AR Web Content Manager AWCM 2.2 allow remote attackers to read arbitrary files and possibly have other unspecified impact via a .. dot dot in the 1 awcmtheme or 2 awcmlang cookie to a index.php or b header.php...

CVE-2010-1066: Undefined Security Weakness

AR Web Content Manager AWCM 2.1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for control/dbbackup.php...