CVE-2007-3558

Coppermine Photo Gallery is affected by CVE-2007-3558: versions before 1.4.11 are vulnerable to a SQL injection via the album password cookie. The root cause is lack of sanitization in get_private_album_set in include/functions.inc.php, allowing remote attackers to manipulate database queries. Po...

CVE-2007-1414

The CVE-2007-1414 issue affects Coppermine Photo Gallery (CPG). Multiple PHP remote file inclusion vulnerabilities allow an attacker to execute arbitrary PHP code by supplying URLs in the affected parameters: (1) cmd in image_processor.php or picmgmt.inc.php, and (2) path in include/functions.php...

CVE-2006-6123

CVE-2006-6123 affects Coppermine Photo Gallery (CPG) 1.4.8 stable. With register_globals enabled, a crafted query string can cause variables to be defined in the global space, bypassing XSS protection and allowing remote attackers to set arbitrary variables via separate _GET, _REQUEST, or other p...

Cross site scripting

Cross-site scripting XSS vulnerability in linking.php in CPG-Nuke Dragonfly CMS 9.0.6.1 allows remote attackers to inject arbitrary web script or HTML via a URI that is generated when creating a list of online users...

CVE-2006-0726

Cross-site scripting XSS vulnerability in linking.php in CPG-Nuke Dragonfly CMS 9.0.6.1 allows remote attackers to inject arbitrary web script or HTML via a URI that is generated when creating a list of online users...

CVE-2006-0726

Cross-site scripting XSS vulnerability in linking.php in CPG-Nuke Dragonfly CMS 9.0.6.1 allows remote attackers to inject arbitrary web script or HTML via a URI that is generated when creating a list of online users...

CVE-2006-0726

CVE-2006-0726 is an XSS vulnerability in linking.php of CPG-Nuke Dragonfly CMS 9.0.6.1. The issue allows remote attackers to inject arbitrary web script or HTML via a URI that is generated when creating a list of online users. Affected component: linking.php within Dragonfly CMS 9.0.6.1. The conn...

CVE-2006-0727

CVE-2006-0727 describes a SQL injection in mstrack.php of MusOX DF MSAnalysis (DFMSA), used with CPG-Nuke Dragonfly CMS. An attacker can trigger path disclosure via a SQL syntax error and may be able to execute arbitrary SQL commands. The affected software is MusOX DF MSAnalysis as used in Dragon...

Directory traversal

Multiple directory traversal vulnerabilities in install.php in CPG-Nuke Dragonfly CMS aka CPG Dragonfly CMS 9.0.6.1 allow remote attackers to include and execute arbitrary local files via directory traversal sequences and a NUL %00 character in 1 the newlang parameter and 2 the installlang...

CVE-2006-0644

Multiple directory traversal vulnerabilities in install.php in CPG-Nuke Dragonfly CMS aka CPG Dragonfly CMS 9.0.6.1 allow remote attackers to include and execute arbitrary local files via directory traversal sequences and a NUL %00 character in 1 the newlang parameter and 2 the installlang...

CVE-2006-0644

Multiple directory traversal vulnerabilities in install.php in CPG-Nuke Dragonfly CMS aka CPG Dragonfly CMS 9.0.6.1 allow remote attackers to include and execute arbitrary local files via directory traversal sequences and a NUL %00 character in 1 the newlang parameter and 2 the installlang...

CVE-2006-0644

Dragonfly CMS (CPG-Nuke) 9.0.6.1 contains multiple directory traversal vulnerabilities in install.php that allow remote attackers to include and execute arbitrary local files. The issue arises from insufficient validation of the newlang parameter and the installlang cookie, which can be exploited...

[SA14748] CPG Dragonfly CMS Two Cross-Site Scripting Vulnerabilities

---------------------------------------------------------------------- Want a new IT Security job? Vacant positions at Secunia: http://secunia.com/secuniavacancies/ ---------------------------------------------------------------------- TITLE: CPG Dragonfly CMS Two Cross-Site Scripting...

CVE-2005-0914

Affected software : CPG Dragonfly 9.0.2.0 (also referenced as CPG-Nuke CMS in connected data). Vulnerability : Multiple cross-site scripting (XSS) flaws that allow remote attackers to inject arbitrary web script or HTML via (1) the profile parameter to index.php or (2) the cat parameter. Root cau...

CVE-2005-0914

Multiple cross-site scripting XSS vulnerabilities in CPG Dragonfly 9.0.2.0 allow remote attackers to inject arbitrary web script or HTML via 1 the profile parameter to index.php or 2 the cat parameter...

CPG Dragonfly Multiple XSS

The version of CPG Dragonfly / CPG-Nuke CMS installed on the remote host suffers from multiple cross-site scripting vulnerabilities due to its failure to sanitize user-input to several variables in various modules. An attacker can exploit these flaws to steal cookie-based authentication credentia...

CPG Dragonfly 9.0.2.0 - Multiple Cross-Site Scripting Vulnerabilities

CPG Dragonfly 9.0.2.0 - Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/12930/info CPG Dragonfly is prone to multiple cross-site scripting vulnerabilities in various modules. An attacker may leverage these issues to have arbitrary script code executed in th...

CPG Dragonfly 9.0.2.0 - Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/12930/info CPG Dragonfly is prone to multiple cross-site scripting vulnerabilities in various modules. An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of...

CVE-2005-0914

Multiple cross-site scripting XSS vulnerabilities in CPG Dragonfly 9.0.2.0 allow remote attackers to inject arbitrary web script or HTML via 1 the profile parameter to index.php or 2 the cat parameter...