CVE-2006-4321

CVE-2006-4321 describes a PHP remote file inclusion in Coppermine Photo Gallery (component com_cpg) 1.0 and earlier for Mambo. An attacker can supply a URL via mosConfig_absolute_path to cause the application to include remote PHP code, enabling arbitrary code execution. The NVD entry notes a CVS...

CVE-2004-1988

The CVE-2004-1988 entry documents a PHP remote file inclusion in Coppermine Photo Gallery 1.2.0 RC4. The vulnerability arises when the CPG_M_DIR setting is manipulated to reference a URL on a remote server that serves functions.inc.php, allowing an attacker to execute arbitrary PHP code on the af...

CVE-2008-0506

CVE-2008-0506 affects Coppermine Photo Gallery (CPG) implemention, specifically picEditor.php when using ImageMagick. The vulnerability arises because the (quality, angle, clipval) parameters are not properly escaped before passing to PHP exec, allowing remote command execution via shell metachar...

CVE-2004-1989

The CVE-2004-1989 entry affects Coppermine Photo Gallery 1.2.2b, where a vulnerability in theme.php allows a remote attacker to execute arbitrary PHP code by altering THEME_DIR to reference a URL containing user_list_info_box.inc. This is a PHP remote file inclusion flaw with network access, no a...

CVE-2006-0873

CVE-2006-0873 affects Coppermine Photo Gallery (docs/showdoc.php, f parameter). It is an absolute path traversal / local file inclusion vulnerability allowing arbitrary file inclusion, potentially from Windows UNC shares. Affected: Coppermine Photo Gallery 1.4.3 and earlier. Root cause: unsanitiz...

CVE-2007-3558

Coppermine Photo Gallery is affected by CVE-2007-3558: versions before 1.4.11 are vulnerable to a SQL injection via the album password cookie. The root cause is lack of sanitization in get_private_album_set in include/functions.inc.php, allowing remote attackers to manipulate database queries. Po...

CVE-2004-1987

The CVE-2004-1987 vulnerability affects Coppermine Photo Gallery versions 1.2.2b and 1.2.0 RC4. It permits remote attackers with administrative privileges to execute arbitrary commands through shell metacharacters in the configuration parameters $CONFIG['impath'] or $CONFIG['jpeg_qual']. The conn...

CVE-2004-1984

The CVE concerns Coppermine Photo Gallery versions 1.2.2b and 1.2.0 RC4. Affected files (phpinfo.php, addpic.php, config.php, db_input.php, displayecard.php, ecard.php, crop.inc.php) can disclose the full server path via a PHP error message when accessed directly, leaking information about the in...

CVE-2007-1414

The CVE-2007-1414 issue affects Coppermine Photo Gallery (CPG). Multiple PHP remote file inclusion vulnerabilities allow an attacker to execute arbitrary PHP code by supplying URLs in the affected parameters: (1) cmd in image_processor.php or picmgmt.inc.php, and (2) path in include/functions.php...

CVE-2005-1172

CVE-2005-1172 describes a cross-site scripting (XSS) vulnerability in Coppermine Photo Gallery 1.3.x, specifically in the file init.inc.php. The issue allows remote attackers to inject arbitrary web script or HTML via the X-Forwarded-For parameter. Multiple connected sources corroborate this as a...

CVE-2007-1107

Coppermine Photo Gallery (CPG) 1.3.x is vulnerable to a SQL injection via the cpg131_fav cookie, allowing remote authenticated users to execute arbitrary SQL commands. The issue was later reported to affect 1.4.x versions (e.g., 1.4.10, 1.4.14) using similar cookies. A Nessus entry additionally n...

CVE-2007-0836

CVE-2007-0836 affects Coppermine Photo Gallery 1.4.10 (and possibly earlier). The issue allows remote authenticated users to include arbitrary local and possibly remote files through the “Path to custom header include” and “Path to custom footer include” fields in admin.php. The underlying flaw i...

CVE-2009-1616

The CVE pertains to Coppermine Photo Gallery (CPG) prior to version 1.4.22, where the docs/showdoc.php script fails to sanitize the css parameter, enabling cross-site scripting. The underlying issue is improper input handling that allows injection of arbitrary script/HTML, with the impact describ...

CVE-2005-2676

The CVE-2005-2676 entry concerns Coppermine Photo Gallery prior to version 1.3.4, where displayimage.php is vulnerable to cross-site scripting via crafted EXIF data. The vulnerability allows an attacker-supplied EXIF payload to be reflected into the HTML/JS context, enabling arbitrary script exec...

CVE-2007-0115

CVE-2007-0115 affects Coppermine Photo Gallery 1.4.10 and earlier. The vulnerability is a static code injection that lets remote authenticated administrators run arbitrary PHP code. The attack path involves injecting PHP code via the Username field to login.php, which is injected into an error me...

CVE-2008-0505

CVE-2008-0505 affects Coppermine Photo Gallery: multiple XSS in docs/showdoc.php before 1.4.15. Attacks inject arbitrary script/HTML via the h and t parameters. Impact is user-visible content tampering; no patch details are provided in the supplied documents. Affected version range and remediatio...

CVE-2007-0835

The CVE-2007-0835 entry applies to Coppermine Photo Gallery 1.4.10 (and possibly earlier). It describes a remote command-injection vulnerability where an authenticated user can execute arbitrary shell commands by injecting shell metacharacters (a semicolon) into the ImageMagick-related input fiel...

CVE-2008-1841

CVE-2008-1841 is a database-injection vulnerability in Coppermine Photo Gallery (CPG) 1.4.17 and earlier. It affects the session handling in bridge/coppermine.inc.php, allowing remote attackers to execute arbitrary SQL commands via a field tied to the session_id variable; exploitation was reporte...

CVE-2006-2514

CVE-2006-2514 affects Coppermine galleries prior to version 1.4.6 when run on Apache with the mod_mime module. The vulnerability allows remote attackers to upload arbitrary files by using a filename containing multiple extensions, enabling potential arbitrary file upload. The core issue is the ha...

CVE-2007-4977

CVE-2007-4977 concerns Coppermine Photo Gallery (CPG) prior to (and including) 1.4.12. The issue is an XSS in mode.php via the referer parameter, as described in the CVE entry and echoed in connected reports. The root cause is improper checking of the referer variable in mode.php, enabling inject...

CVE-2006-1909

The CVE-2006-1909 vulnerability affects Coppermine Photo Gallery, specifically index.php in version 1.4.4. It allows Local File Inclusion/Directory Traversal through the file parameter using patterns like .//./, collapsing to ../ and enabling reading arbitrary local files and potentially executin...

CVE-2004-1985

CVE-2004-1985 describes a cross-site scripting (XSS) vulnerability in Coppermine Photo Gallery 1.2.2b, specifically in menu.inc.php via the CPG_URL parameter. The issue allows remote attackers to inject arbitrary HTML or script. The provided sources (NVD/CVELIST) confirm the affected product/vers...

CVE-2004-1986

CVE-2004-1986 describes a directory traversal vulnerability in Coppermine Photo Gallery, specifically in modules.php. The affected versions are Coppermine Photo Gallery 1.2.2b and 1.2.0 RC4, where remote attackers with administrative privileges can read arbitrary files by injecting a '..' sequenc...

CVE-2007-0122

Coppermine Photo Gallery 1.4.10 and earlier has multiple SQL injection vulnerabilities that allow remote authenticated administrators to execute arbitrary SQL commands. Affected parameters include (1) cat in albmgr.php, (2) gid in usermgr.php, (3) start in db_ecard.php, and (4) albumid in unspeci...

CVE-2007-4283

The CVE-2007-4283 entry describes a PHP remote file inclusion vulnerability in Coppermine Photo Gallery (CPG) 1.3.1, specifically in bridge/yabbse.inc.php where an attacker can supply a URL via the sourcedir parameter to execute arbitrary PHP code. Affected software is Coppermine Photo Gallery; t...

CVE-2006-2976

CVE-2006-2976 affects Coppermine Photo Gallery, specifically the file usermgr.php, with the vulnerability present in releases prior to 1.4.7. The available documents describe an unspecified vulnerability with unknown impact and remote attack vectors, potentially tied to authorization/authenticati...

CVE-2006-3064

The CVE-2006-3064 entry affects Coppermine Photo Gallery (CPG) 1.4.8; a SQL injection exists in the add_hit function within include/function.inc.php when Keep detailed hit statistics is enabled. Remote attackers can potentially execute arbitrary SQL commands by supplying crafted values in the Ref...

CVE-2005-1225

CVE-2005-1225 is an SQL injection vulnerability affecting Coppermine Photo Gallery 1.3.2, where the vulnerability exists in the way the server processes the favs parameter sent to either init.inc.php or zipdownload.php . The affected component is the web application’s PHP code handling these scri...

CVE-2005-1226

CVE-2005-1226 affects Coppermine Photo Gallery 1.3.2, where passwords are stored in plaintext. This enables remote attackers to obtain sensitive information and potentially compromise accounts. The NVD entry reports a CVSS2 base score of 7.5 (HIGH) with network access, low attack complexity, no a...

CVE-2006-0872

CVE-2006-0872 describes a directory traversal vulnerability in Coppermine Photo Gallery

CVE-2008-1840

CVE-2008-1840 affects Coppermine Photo Gallery (CPG) up to version 1.4.16. The vulnerability is an SQL injection in upload.php that can be exploited via the Content-Type HTTP header used during an upload. It can be exploited by remote authenticated users or user‑assisted remote HTTP servers to ex...

CVE-2007-4976

CVE-2007-4976 involves a directory traversal in Coppermine Photo Gallery (CPG) prior to or including 1.4.12. The flaw is in viewlog.php: an unsafely handled log parameter can be exploited to include and execute arbitrary local files by using ".." (dot dot). The vulnerability requires authenticati...

CVE-2006-5622

CVE-2006-5622 affects Coppermine Photo Gallery 1.4.9, where SQL injection is possible in picmgr.php via the aid parameter. This could allow remote attackers to execute arbitrary SQL commands. The provided documents do not specify a fixed version patch or remediation, and exploitation details are ...

CVE-2007-5888

CVE-2007-5888 is a cross-site scripting (XSS) vulnerability in Coppermine Photo Gallery (CPG) that affects the file displayecard.php. It allows remote attackers to inject arbitrary web script or HTML via the data parameter in versions before 1.4.14. The documented impact is injection of script/HT...

CVE-2006-6123

CVE-2006-6123 affects Coppermine Photo Gallery (CPG) 1.4.8 stable. With register_globals enabled, a crafted query string can cause variables to be defined in the global space, bypassing XSS protection and allowing remote attackers to set arbitrary variables via separate _GET, _REQUEST, or other p...