CVE-2009-1677: Improper Control of Generation of Code

Multiple static code injection vulnerabilities in the saveFeed function in rss/feedcreator.class.php in Bitweaver 2.6 and earlier allow 1 remote authenticated users to inject arbitrary PHP code into files by placing PHP sequences into the account's "display name" setting and then invoking...

CVE-2009-1678: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the saveFeed function in rss/feedcreator.class.php in Bitweaver 2.6 and earlier allows remote attackers to create or overwrite arbitrary files via a .. dot dot in the version parameter to boards/boardsrss.php...