CVE-2013-3638

CVE-2013-3638 describes a SQL injection in BoonEx Dolphin prior to 7.1.3. The flaw arises from insufficient validation of the pathes[] HTTP POST parameter passed to /administration/categories.php, allowing a remote authenticated user to execute arbitrary SQL commands in the database (with CSRF ri...

CVE-2012-0873

CVE-2012-0873 : BoonEx Dolphin prior to 7.0.8 contains multiple stored/reflective XSS vulnerabilities in the web UI, exploitable via parameters (explain in explanation.php; photos_only, online_only, or mode in viewFriends.php). Affected versions include 7.0.7 and earlier; an attacker could inject...

CVE-2006-4189

Summary: BoonEx Dolphin 5.1 (and Dolphin 5.2 per related CVEs) is affected by PHP remote file inclusion via dir[inc] parameters in multiple scripts (e.g., index.php, aemodule.php, browse.php, cc.php, etc.). The underlying issue is improper inclusion of user-supplied URL input, enabling remote cod...

CVE-2014-3810

Dolphin (BoonEx)

CVE-2011-3728

CVE-2011-3728 concerns Dolphin 7.0.4, where remote attackers can obtain sensitive information by requesting a specific PHP file. The vulnerability exposes the installation path in an error message, demonstrated by files such as xmlrpc/BxDolXMLRPCProfileView.php. The issue is a information disclos...

CVE-2008-3167

CVE-2008-3167 concerns BoonEx Dolphin 6.1.2 and related components, showing multiple PHP remote file inclusion vulnerabilities. The issues allow an attacker to execute arbitrary PHP code by supplying a URL to unsafely handled inputs: (1) dir[plugins] to HTMLSax3.php and safehtml.php within plugin...

CVE-2014-4333

BoonEx Dolphin 7.1.4 and earlier contains a CSRF vulnerability in administration/profiles.php that enables remote attackers to hijack administrator sessions for requests that trigger an SQL injection via the members[] parameter. The issue is related to CVE-2014-3810, which confirms an SQL injecti...

CVE-2006-5410

CVE-2006-5410 is a PHP remote file inclusion vulnerability in BoonEx Dolphin 5.2. The issue affects templates/tmpl_dfl/scripts/index.php and allows an attacker to execute arbitrary PHP code by supplying a URL in the dir[inc] parameter. This results in remote code execution with partial confidenti...

CVE-2021-27969

Dolphin CMS 7.4.2 has a stored XSS flaw exploitable via the Page Builder “width” parameter. Multiple sources (NVD, Red Hat, OSV, CVE registries) consistently describe this issue as a stored cross-site scripting vulnerability in Dolphin CMS 7.4.2, with the root cause being unsafely handled input f...