CVE-2005-4132

Summary: CVE-2005-4132 affects Contenido prior to version 4.6.4. The vulnerability is described as a PHP remote file inclusion due to improper sanitization when PHP’s register_globals is enabled and allow_url_fopen is true, enabling an attacker to potentially read arbitrary files or execute code ...

CVE-2006-5380

Contenido CMS suffers a remote file inclusion (RFI) vulnerability in CVE-2006-5380 via the contenido_path parameter to cms/dbfs.php or cms/front_content.php, enabling arbitrary PHP code execution. Note: CVE disputes this for version 4.6.15 where contenido_path is static. In practice, mitigation g...

CVE-2014-9433

Contenido CMS contains multiple XSS vulnerabilities in cms/front_content.php up to version 4.9.6, exploitable when advanced mod rewrite (AMR) is disabled. An attacker can inject arbitrary script via the idart, lang, or idcat parameters. OpenVAS notes a VendorFix remediation (Content release 4.9.6).

CVE-2008-2911

CVE-2008-2911 describes multiple cross-site scripting (XSS) vulnerabilities in the Contenido 4.8.4 index.php, exploitable via the parameters (1) contenido, (2) Belang, and (3) username. The adjacent documents consistently identify the issue as XSS without detailing a specific exploit vector beyon...

CVE-2006-5381

CVE-2006-5381 : Contenido CMS stores sensitive data under the web root with insufficient access control, enabling remote attackers to obtain database credentials and other information via direct requests to8 files in the conlib/ directory (db_msql.inc, db_mssql.inc, db_mysqli.inc, db_oci8.inc, db...