CVE-2007-1525

CVE-2007-1525 affects Dayfox Blog (dfblog) 4. The vulnerability is in the file that serves posts (posts.php) via the parameter cat passed to postpost.php, enabling direct static code injection and remote execution of arbitrary PHP by an attacker. Public references in connected documents indicate ...

CVE-2008-3564

The CVE-2008-3564 entry concerns multiple directory traversal flaws in Dayfox Blog 4’s index.php. The vulnerability allows remote attackers to include and execute arbitrary local files by manipulating the dot-dot sequences in the (1) p, (2) cat, and (3) archive parameters. In some environments th...

CVE-2007-0150

CVE-2007-0150 affects Dayfox Blog’s index.php, with multiple PHP remote file inclusion vulnerabilities exploitable via user-supplied URL parameters (page, subject, q). The vulnerability stems from unsafely including remote content based on these parameters, allowing an attacker to execute arbitra...

CVE-2006-5183

CVE-2006-5183 affects Dayfox Designs Dayfox Blog 2.0 and involves multiple PHP remote file inclusion flaws in the /edit scripts (adminlog.php, postblog.php, index.php, index2.php). The underlying issue is unsafely constructed URLs in the slogin parameter, allowing an attacker to supply a remote P...

CVE-2006-2522

CVE-2006-2522 affects Dayfox Blog 2.0 and earlier. The credential store is kept in edit/slog_users.txt at the web document root with insufficient access control, enabling remote attackers to gain privileges. The connected sources confirm this direct exposure of user credentials and the resulting ...