Design/Logic Flaw

Acidcat CMS 3.4.1 does not properly restrict access to 1 defaultmailaspemail.asp, 2 defaultmailcdosys.asp or 3 defaultmailjmail.asp, which allows remote attackers to bypass restrictions and relay email messages with modified From, FromName, and To fields...

CVE-2008-1993

Acidcat CMS 3.4.1 does not restrict access to the FCKEditor component, which allows remote attackers to upload arbitrary files...

CVE-2008-1991

Cross-site scripting XSS vulnerability in admincolorsswatch.asp in Acidcat CMS 3.4.1 allows remote attackers to inject arbitrary web script or HTML via the field parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in admincolorsswatch.asp in Acidcat CMS 3.4.1 allows remote attackers to inject arbitrary web script or HTML via the field parameter...

CVE-2008-1992

Acidcat CMS 3.4.1 does not properly restrict access to 1 defaultmailaspemail.asp, 2 defaultmailcdosys.asp or 3 defaultmailjmail.asp, which allows remote attackers to bypass restrictions and relay email messages with modified From, FromName, and To fields...

CVE-2008-1993

CVE-2008-1993 affects Acidcat CMS 3.4.1 where the FCKEditor component is not access-restricted, enabling remote upload of arbitrary files. Based on the NVD entry, the flaw is exploitable over the network with low attack complexity and no authentication, potentially impacting confidentiality, inte...

CVE-2008-1991

CVE-2008-1991 describes an XSS vulnerability in Acidcat CMS 3.4.1, specifically in admin_colors_swatch.asp, where a crafted value passed to the field parameter enables injection of arbitrary web script/HTML. The available sources confirm a stored/reflective-style risk to pages that render the par...

CVE-2008-1990

CVE-2008-1990 : Acidcat CMS 3.4.1 contains multiple SQL injection vulnerabilities that allow remote attackers to execute arbitrary SQL commands through the (1) cID parameter on default.asp and (2) username parameter on main_login2.asp. The exists documentation identifies the affected software and...

CVE-2008-1990

Multiple SQL injection vulnerabilities in Acidcat CMS 3.4.1 allow remote attackers to execute arbitrary SQL commands via the 1 cID parameter to default.asp and the 2 username parameter to mainlogin2.asp...

CVE-2008-1992

The CVE-2008-1992 entry concerns Acidcat CMS 3.4.1, where access to (1) default_mail_aspemail.asp, (2) default_mail_cdosys.asp, and (3) default_mail_jmail.asp is not properly restricted. This improper access could allow remote attackers to bypass restrictions and relay email messages with modifie...

CVE-2008-1991

Cross-site scripting XSS vulnerability in admincolorsswatch.asp in Acidcat CMS 3.4.1 allows remote attackers to inject arbitrary web script or HTML via the field parameter...

CVE-2008-1992

Acidcat CMS 3.4.1 does not properly restrict access to 1 defaultmailaspemail.asp, 2 defaultmailcdosys.asp or 3 defaultmailjmail.asp, which allows remote attackers to bypass restrictions and relay email messages with modified From, FromName, and To fields...

acidcat-multi.txt

www.BugReport.ir AmnPardaz Security Research Team Title: Acidcat CMS Multiple Vulnerabilities. Vendor: www.acidcat.com Vulnerable Version: 3.4.1 Exploit: Available Impact: High Fix: N/A Original Advisory: http://bugreport.ir/index.php?/36 1. Description: Acidcat CMS is a web site and simple Conte...

Acidcat CMS 3.4.1 Multiple Remote Vulnerabilities

No description provided by source. www.BugReport.ir AmnPardaz Security Research Team Title: Acidcat CMS Multiple Vulnerabilities. Vendor: www.acidcat.com Vulnerable Version: 3.4.1 Exploit: Available Impact: High Fix: N/A Original Advisory: http://bugreport.ir/index.php?/36 1. Description: Acidcat...

Acidcat CMS Multiple Vulnerabilities

www.BugReport.ir AmnPardaz Security Research Team Title: Acidcat CMS Multiple Vulnerabilities. Vendor: www.acidcat.com Vulnerable Version: 3.4.1 Exploit: Available Impact: High Fix: N/A Original Advisory: http://bugreport.ir/index.php?/36 1. Description: Acidcat CMS is a web site and simple Conte...

Acidcat CMS 3.4.1 - Multiple Vulnerabilities

www.BugReport.ir AmnPardaz Security Research Team Title: Acidcat CMS Multiple Vulnerabilities. Vendor: www.acidcat.com Vulnerable Version: 3.4.1 Exploit: Available Impact: High Fix: N/A Original Advisory: http://bugreport.ir/index.php?/36 1. Description: Acidcat CMS is a web site and simple Conte...

Acidcat CMS 3.4.1 Multiple Remote Vulnerabilities

Exploit for unknown platform in category web applications ================================================= Acidcat CMS 3.4.1 Multiple Remote Vulnerabilities ================================================= AmnPardaz Security Research Team Title: Acidcat CMS Multiple Vulnerabilities. Vendor:...

Acidcat CMS 3.4.1 - Multiple Vulnerabilities

Acidcat CMS 3.4.1 - Multiple Vulnerabilities www.BugReport.ir AmnPardaz Security Research Team Title: Acidcat CMS Multiple Vulnerabilities. Vendor: www.acidcat.com Vulnerable Version: 3.4.1 Exploit: Available Impact: High Fix: N/A Original Advisory: http://bugreport.ir/index.php?/36 1. Descriptio...

Acidcat-bypass.txt

http://hamid.ir Acidcat CMS is a web site and simple content management system that can be administered via a web browser. It is free for non-commercial use.Acidcat CMS is also an open source product. The product has been found to contain multiple security vulnerabilities allowing a remote attack...

CVE-2005-4371

Acidcat 2.1.13 and earlier stores the database under the web root with insufficient access control, which allows remote attackers to obtain sensitive information via a request to databases/acidcat.mdb...