PT-2019-6784

Name of the Vulnerable Software and Affected Versions Bitweaver versions 2.8.1 and earlier Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the path info to certain API endpoints such as "stats/index.php" or "newsletters/edition.php", ...

CVE-2012-5193: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Bitweaver 2.8.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the path info to 1 stats/index.php or 2 newsletters/edition.php or the 3 username parameter to users/remindpassword.php, 4 days parameter to...

CVE-2008-4337: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Bitweaver 2.0.2 allows remote attackers to inject arbitrary web script or HTML via the URL parameter to 1 edit.php and 2 list.php in articles/; 3 listblogs.php and 4 rankings.php in blogs/; 5 calendar/index.php; 6 calendar.php, 7 index.php, and 8...

CVE-2006-6923: Undefined Security Weakness

SQL injection vulnerability in newsletters/edition.php in bitweaver 1.3.1 and earlier allows remote attackers to execute arbitrary SQL commands via the tk parameter...