CVE-2007-1965: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in eXV2 CMS 2.0.4.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the setlang parameter to 1 archive.php, 2 article.php, 3 index.php, or 4 topics.php...

[MajorSecurity Advisory #38]eXV2 CMS - Session fixation and Cross-Site-Scripting Issues

""""""""""""""""""""""""""""""""""""""""""""""" """ :: :: ::::: :::: """ """ :: :: :: : :: """ """ :::: :: :: ::::: ::::: :::: """ """ :: :: ::: ::: :: :: :: :: :: """ """ :: :: :: : : ::::: :: :: :::: """ """ """ """"""""""""""""""""""""""""""""""""""""""""""" Xmor$ Security Vulnerability Resear...

CVE-2006-7080

Directory traversal vulnerability in the avatar upload feature in exV2 2.0.4.3 and earlier allows remote attackers to delete arbitrary files via ".." sequences in the oldavatar parameter...

CVE-2006-7079

CVE-2006-7079 affects exV2 versions 2.0.4.3 and earlier, in include/common.php. The issue allows remote attackers to overwrite arbitrary program variables and perform directory traversal to execute arbitrary code by modifying xoopsOption['pagetype']. The initial docs provide CVSS data: CVSS v2 ba...

CVE-2006-7079

Variable extraction vulnerability in include/common.php in exV2 2.0.4.3 and earlier allows remote attackers to overwrite arbitrary program variables and conduct directory traversal attacks to execute arbitrary code by modifying the $xoopsOption'pagetype' variable...

CVE-2006-7080

Directory traversal vulnerability in the avatar upload feature in exV2 2.0.4.3 and earlier allows remote attackers to delete arbitrary files via ".." sequences in the oldavatar parameter...

CVE-2006-7080

Summary: CVE-2006-7080 affects exV2 versions up to 2.0.4.3, where the avatar upload feature is vulnerable to a directory traversal via the old_avatar parameter. Attacker-controlled ".." sequences can be used to delete arbitrary files on the server. The vulnerability is categorized with a CVSS v2 ...

CVE-2006-7079: Improper Limitation of a Pathname to a Restricted Directory

Variable extraction vulnerability in include/common.php in exV2 2.0.4.3 and earlier allows remote attackers to overwrite arbitrary program variables and conduct directory traversal attacks to execute arbitrary code by modifying the $xoopsOption'pagetype' variable...

CVE-2006-7080: Undefined Security Weakness

Directory traversal vulnerability in the avatar upload feature in exV2 2.0.4.3 and earlier allows remote attackers to delete arbitrary files via ".." sequences in the oldavatar parameter...

PT-2007-1358 · Exv2 · Exv2

Name of the Vulnerable Software and Affected Versions: exV2 versions 2.0.4.3 and earlier Description: The issue allows remote attackers to overwrite arbitrary program variables and conduct directory traversal attacks to execute arbitrary code. This is achieved by modifying the xoopsOption'pagetyp...

CVE-2006-5030

CVE-2006-5030 describes an SQL injection in exV2 2.0.4.3 and earlier, affecting the modules/messages/index.php file. The vulnerability is triggered by the sort parameter and permits remote authenticated users to execute arbitrary SQL commands. The NVD metrics indicate high severity (base score 7....

CVE-2006-5030

SQL injection vulnerability in modules/messages/index.php in exV2 2.0.4.3 and earlier allows remote authenticated users to execute arbitrary SQL commands via the sort parameter...

CVE-2006-5030: Undefined Security Weakness

SQL injection vulnerability in modules/messages/index.php in exV2 2.0.4.3 and earlier allows remote authenticated users to execute arbitrary SQL commands via the sort parameter...

exV2 <= 2.0.4.3 extract() Remote Command Execution Exploit

Exploit for unknown platform in category web applications ========================================================== exV2 = 2.0.4.3 extract Remote Command Execution Exploit ========================================================== !/usr/bin/php -q -d shortopentag=on ? printr'...

exV2 < 2.0.4.3 - 'sort' SQL Injection

!/usr/bin/php -q -d shortopentag=on = 4.1 allowing subs and if 'messages' module is enabled / if $argc 126 $result.=" ."; else $result.=" ".$string$i; if strlendechexord$string$i==2 $exa.=" ".dechexord$st...

exV2 <= 2.0.4.3 (sort) Remote SQL Injection Exploit

Exploit for unknown platform in category web applications =================================================== exV2 = 4.1 allowing subs and if 'messages' module is enabled / if $argc4 printr' ----------------------------------------------------------------------------- Usage: php '.$argv0.' host...

exV2 2.0.4.3 - sort SQL Injection

exV2 2.0.4.3 - sort SQL Injection !/usr/bin/php -q -d shortopentag=on = 4.1 allowing subs and if 'messages' module is enabled / if $argc 126 $result.=" ."; else $result.=" ".$string$i; if strlendechexord$string$i...

exV2 &lt;= 2.0.4.3 (sort) Remote SQL Injection Exploit

No description provided by source. !/usr/bin/php -q -d shortopentag=on ? printr' ------------------------------------------------------------------------------- exV2 = 2.0.4.3 "sort" SQL injection / administrative credentials disclosure exploit mail: [email protected] site:...