Lexiglot Path Traversal Vulnerability

Lexiglot is a translation platform written in PHP by the French software developer Damien Sorel. A path traversal vulnerability exists in Lexiglot 2014-11-20 and earlier versions, which can be exploited by remote attackers to obtain sensitive information full path with the help of...

Lexiglot Information Disclosure Vulnerability (CNVD-2020-36284)

Lexiglot is a translation platform written in PHP by the French software developer Damien Sorel. An information disclosure vulnerability exists in Lexiglot 2014-11-20 and earlier versions, which stems from the presence of usernames and passwords on the command line and can be exploited by a local...

CVE-2014-8937

Lexiglot through 2014-11-20 allows denial of service because api/update.php launches svn update operations that use a great deal of resources...

CVE-2014-8938

Lexiglot through 2014-11-20 allows local users to obtain sensitive information by listing a process because the username and password are on the command line...

CVE-2014-8942

Lexiglot through 2014-11-20 allows CSRF...

CVE-2014-8943

Lexiglot through 2014-11-20 allows SSRF via the admin.php?page=projects svnurl parameter...

CVE-2014-8940

Lexiglot through 2014-11-20 allows remote attackers to obtain sensitive information names and details of projects by visiting the /update.log URI...

CVE-2014-8939

Lexiglot through 2014-11-20 allows remote attackers to obtain sensitive information full path via an include/smarty/plugins/modifier.dateformat.php request if PHP has a non-recommended configuration that produces warning messages...

CVE-2014-8941

Lexiglot through 2014-11-20 allows SQL injection via an admin.php?page=users&fromid= or admin.php?page=history&limit= URI...

Sql injection

Lexiglot through 2014-11-20 allows SQL injection via an admin.php?page=users&fromid= or admin.php?page=history&limit= URI...

Design/Logic Flaw

Lexiglot through 2014-11-20 allows remote attackers to obtain sensitive information names and details of projects by visiting the /update.log URI...

Cross site scripting

Lexiglot through 2014-11-20 allows XSS Reflected via the username, or XSS Stored via the admin.php?page=config installname, intromessage, or newfilecontent parameter...

Command injection

admin.php?page=projects in Lexiglot through 2014-11-20 allows command injection via username and password fields...

Server side request forgery (ssrf)

Lexiglot through 2014-11-20 allows SSRF via the admin.php?page=projects svnurl parameter...

Code injection

Lexiglot through 2014-11-20 allows denial of service because api/update.php launches svn update operations that use a great deal of resources...

Cross site request forgery (csrf)

Lexiglot through 2014-11-20 allows CSRF...

Default credentials

Lexiglot through 2014-11-20 allows local users to obtain sensitive information by listing a process because the username and password are on the command line...

CVE-2014-8941

Lexiglot through 2014-11-20 allows SQL injection via an admin.php?page=users&fromid= or admin.php?page=history&limit= URI...

CVE-2014-8941

CVE-2014-8941 affects Lexiglot (PHP translation platform) through 2014-11-20. The issue is a SQL injection vulnerability arising from unsafely built queries in the admin interface, specifically via URLs like admin.php?page=users&from_id= and admin.php?page=history&limit=. Evidence across multiple...

CVE-2014-8942

CVE-2014-8942 affects Lexiglot (a PHP-based translation platform). Connected sources confirm a cross-site request forgery vulnerability present in Lexiglot through 2014-11-20, caused by insufficient validation of user input (CNVD-2020-41798). Documented references consistently describe CSRF risk ...