CVE-2005-2676

The CVE-2005-2676 entry concerns Coppermine Photo Gallery prior to version 1.3.4, where displayimage.php is vulnerable to cross-site scripting via crafted EXIF data. The vulnerability allows an attacker-supplied EXIF payload to be reflected into the HTML/JS context, enabling arbitrary script exec...

Coppermine Gallery < 1.3.4 displayimage.php HTML Injection (deprecated)

Binary data 3178.prm...

FreeBSD : coppermine -- IP spoofing and XSS vulnerability (756db070-b9d4-11d9-ae81-000ae42e9b93)

GHC team reports about coppermine The lack of sanitizing of user defined variables may result in undesirable consequences such as IP spoofing or XSS attack. Generally users of Coppermine Gallery can post comments. Remote address & x-forwarded-for variables are logged for admin's eyes...

waraxe-2005-SA042.txt

================================================================================ waraxe-2005-SA042 ================================================================================ Multiple vulnerabilities in Coppermine Photo Gallery 1.3.2...

CVE-2004-1989

The CVE-2004-1989 entry affects Coppermine Photo Gallery 1.2.2b, where a vulnerability in theme.php allows a remote attacker to execute arbitrary PHP code by altering THEME_DIR to reference a URL containing user_list_info_box.inc. This is a PHP remote file inclusion flaw with network access, no a...

CVE-2004-1984

The CVE concerns Coppermine Photo Gallery versions 1.2.2b and 1.2.0 RC4. Affected files (phpinfo.php, addpic.php, config.php, db_input.php, displayecard.php, ecard.php, crop.inc.php) can disclose the full server path via a PHP error message when accessed directly, leaking information about the in...

CVE-2004-1988

PHP remote file inclusion vulnerability in init.inc.php in Coppermine Photo Gallery 1.2.0 RC4 allows remote attackers to execute arbitrary PHP code by modifying the CPGMDIR to reference a URL on a remote web server that contains functions.inc.php...

CVE-2004-1985

Cross-site scripting XSS vulnerability in menu.inc.php in Coppermine Photo Gallery 1.2.2b allows remote attackers to inject arbitrary HTML or web script via the CPGURL parameter...

CVE-2004-1986

CVE-2004-1986 describes a directory traversal vulnerability in Coppermine Photo Gallery, specifically in modules.php. The affected versions are Coppermine Photo Gallery 1.2.2b and 1.2.0 RC4, where remote attackers with administrative privileges can read arbitrary files by injecting a '..' sequenc...

CVE-2004-1989

PHP remote file inclusion vulnerability in theme.php in Coppermine Photo Gallery 1.2.2b allows remote attackers to execute arbitrary PHP code by modifying the THEMEDIR parameter to reference a URL on a remote web server that contains userlistinfobox.inc...

CVE-2004-1984

Coppermine Photo Gallery 1.2.2b and 1.2.0 RC4 allows remote attackers to obtain sensitive information via a direct HTTP request to 1 phpinfo.php, 2 addpic.php, 3 config.php, 4 dbinput.php, 5 displayecard.php, 6 ecard.php, 7 crop.inc.php, which reveal the full path in a PHP error message...

CVE-2004-1985

CVE-2004-1985 describes a cross-site scripting (XSS) vulnerability in Coppermine Photo Gallery 1.2.2b, specifically in menu.inc.php via the CPG_URL parameter. The issue allows remote attackers to inject arbitrary HTML or script. The provided sources (NVD/CVELIST) confirm the affected product/vers...

CVE-2004-1988

The CVE-2004-1988 entry documents a PHP remote file inclusion in Coppermine Photo Gallery 1.2.0 RC4. The vulnerability arises when the CPG_M_DIR setting is manipulated to reference a URL on a remote server that serves functions.inc.php, allowing an attacker to execute arbitrary PHP code on the af...

CVE-2004-1987

The CVE-2004-1987 vulnerability affects Coppermine Photo Gallery versions 1.2.2b and 1.2.0 RC4. It permits remote attackers with administrative privileges to execute arbitrary commands through shell metacharacters in the configuration parameters $CONFIG['impath'] or $CONFIG['jpeg_qual']. The conn...

CVE-2005-1226

Coppermine Photo Gallery 1.3.2 stores passwords in plaintext, which allows remote attackers to obtain sensitive information...

CVE-2005-1172

Cross-site scripting XSS vulnerability in init.inc.php in Coppermine Photo Gallery 1.3.x allows remote attackers to inject arbitrary web script or HTML via the X-Forwarded-For parameter...

CVE-2005-1225

SQL injection vulnerability in Coppermine Photo Gallery 1.3.2 allows remote attackers to execute arbitrary SQL commands via the favs parameter to 1 init.inc.php or 2 zipdownload.php...

CVE-2005-1226

Coppermine Photo Gallery 1.3.2 stores passwords in plaintext, which allows remote attackers to obtain sensitive information...

CVE-2005-1225

SQL injection vulnerability in Coppermine Photo Gallery 1.3.2 allows remote attackers to execute arbitrary SQL commands via the favs parameter to 1 init.inc.php or 2 zipdownload.php...

CVE-2005-1225

CVE-2005-1225 is an SQL injection vulnerability affecting Coppermine Photo Gallery 1.3.2, where the vulnerability exists in the way the server processes the favs parameter sent to either init.inc.php or zipdownload.php . The affected component is the web application’s PHP code handling these scri...