CVE-2005-0443

index.php in CubeCart 2.0.4 allows remote attackers to 1 obtain the full path for the web server or 2 conduct cross-site scripting XSS attacks via an invalid language parameter, which echoes the parameter in a PHP error message...

CVE-2004-2519

Gattaca Server 2003 1.1.10.0 allows remote attackers to cause a denial of service CPU consumption via directory specifiers in the LANGUAGE parameter to 1 index.tmpl and 2 web.tmpl, such as a slash "/", b backslash "", c dot ".",, d dot dot "..", and e internal slash "lang//en"...

CVE-2003-0038

Removed by vendor...

CVE-2002-0463

home.php in ARSC Really Simple Chat 1.0.1 and earlier allows remote attackers to determine the full pathname of the web server via an invalid language in the arsclanguage parameter, which leaks the pathname in an error message...