CVE-2007-1175

Cross-site scripting XSS vulnerability in an admin feature in WebAPP before 20070209 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2007-1184

The default configuration of WebAPP before 0.9.9.5 has a CAPTCHA setting of "no," which makes it easier for automated programs to submit false data...

CVE-2007-1182

WebAPP before 0.9.9.5 allows remote Guest users to edit a Guest profile, which has unknown impact...

Design/Logic Flaw

WebAPP before 0.9.9.5 allows remote attackers to submit Search form input that is not checked for 1 composition or 2 length, which has unknown impact, possibly related to "search form hijacking"...

Cross site scripting

Cross-site scripting XSS vulnerability in an admin feature in WebAPP before 20070209 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

WebAPP before 0.9.9.5 does not properly filter certain characters in contexts related to 1 the query string, 2 Profiles, 3 the Forum Post icon field, 4 the Edit Profile, and 5 the Gallery, which has unknown impact and remote attack vectors, possibly related to cross-site scripting XSS...

Design/Logic Flaw

WebAPP before 0.9.9.5 does not check access in certain contexts related to 1 Calendar Administration, 2 Instant Messages Administration, and 3 the Image Uploader, which has unknown impact and attack vectors...

CVE-2007-1186

WebAPP before 0.9.9.5 does not "censor" the Latest Member real name, which has unknown impact...

Design/Logic Flaw

WebAPP before 0.9.9.5 does not properly manage e-mail addresses in certain contexts related to 1 the Recommend feature, Email Article 2 senders and 3 recipients, 4 New User Approval, 5 Edit Profiles, 6 the Newsletter Subscription form, 7 the Recommend form, and 8 sending of articles, which has...

Design/Logic Flaw

WebAPP before 0.9.9.5 allows remote authenticated users to spoof another user's Real Name via whitespace, which has unknown impact and attack vectors...

Cross site request forgery (csrf)

WebAPP before 0.9.9.5 does not check referrers in certain forms, which might facilitate remote cross-site request forgery CSRF attacks or have other unknown impact...

Default configuration

The default configuration of WebAPP before 0.9.9.5 has a CAPTCHA setting of "no," which makes it easier for automated programs to submit false data...

Design/Logic Flaw

The 1 Search, 2 Edit Profile, 3 Recommend, and 4 User Approval forms in WebAPP before 0.9.9.5 use hidden inputs, which has unknown impact and remote attack vectors...

CVE-2007-1185

The 1 Search, 2 Edit Profile, 3 Recommend, and 4 User Approval forms in WebAPP before 0.9.9.5 use hidden inputs, which has unknown impact and remote attack vectors...

CVE-2007-1182

WebAPP before 0.9.9.5 allows remote Guest users to edit a Guest profile, which has unknown impact...

Design/Logic Flaw

WebAPP before 0.9.9.5 allows remote Guest users to edit a Guest profile, which has unknown impact...

CVE-2007-1176

WebAPP is affected by multiple XSS vulnerabilities in versions before 0.9.9.5, allowing remote attackers to inject arbitrary script/HTML via vectors including Gallery Comments pages, Feedback pages, Search Results pages, and the Statistics Log viewer. The impact is the ability to execute script i...

CVE-2007-1181

CVE-2007-1181 affects WebAPP versions before 0.9.9.5. The root cause is that the application passes unused information and the username through Edit Profile forms, with impact and attack vectors described as unknown in the sources. The connected documents do not provide explicit remediation, expl...

CVE-2007-1174

CVE-2007-1174 describes multiple XSS vulnerabilities in WebAPP prior to 20070214, allowing remote attackers to inject arbitrary script/HTML via unspecified vectors related to user Profiles. The NVD entry lists a base CVSS v2 score of 4.3 (Medium) with impact: integrity partially affected, confide...

CVE-2007-1178

WebAPP before 0.9.9.5 does not check access in certain contexts related to 1 Calendar Administration, 2 Instant Messages Administration, and 3 the Image Uploader, which has unknown impact and attack vectors...