EUVD-2020-6010

Malware in sbrugna...

CVE-2020-13795

An issue was discovered in Navigate CMS through 2.8.7. It allows Directory Traversal because lib/packages/templates/template.class.php mishandles ../ and ..\ substrings...

CVE-2020-13795: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered in Navigate CMS through 2.8.7. It allows Directory Traversal because lib/packages/templates/template.class.php mishandles ../ and ..\ substrings...

PT-2020-13681

Name of the Vulnerable Software and Affected Versions Navigate CMS versions through 2.8.7 Description The issue allows Directory Traversal because the template.class.php file in the lib/packages/templates directory mishandles ../ and .. substrings. Recommendations For versions through 2.8.7, upda...

CVE-2008-2018

The AssignUser function in template.class.php in PHPizabi 0.848b C1 HFP3 performs unsafe macro expansions on strings delimited by '' and '' characters, which allows remote authenticated users to obtain sensitive information via a comment containing a macro, as demonstrated by a "user.password"...

CVE-2008-2018

CVE-2008-2018 affects PHPizabi 0.848b C1 HFP3. The AssignUser function in template.class.php performs unsafe macro expansions on strings delimited by { and }, enabling remote authenticated users to extract sensitive data via a macro in a comment (e.g., {user.password}) on an admin profile. The is...

CVE-2008-2018: Exposure of Sensitive Information to an Unauthorized Actor

The AssignUser function in template.class.php in PHPizabi 0.848b C1 HFP3 performs unsafe macro expansions on strings delimited by '' and '' characters, which allows remote authenticated users to obtain sensitive information via a comment containing a macro, as demonstrated by a "user.password"...

CVE-2007-1486: Undefined Security Weakness

PHP remote file inclusion vulnerability in template.class.php in Carbonize Lazarus Guestbook before 1.7.3 allows remote attackers to execute arbitrary PHP code via a URL in the includepath parameter to admin.php, probably due to a dynamic variable evaluation vulnerability...