CVE-2006-5016

The CVE concerns Szava Gyula and Csaba Tamas e-Vision CMS (likely version 1.0). The vulnerable component is admin/x_image.php, where an unrestricted file upload allows remote attackers to place arbitrary files in the /imagebank directory. The vulnerability’s root cause is an unconstrained upload ...

CVE-2008-6551

CVE-2008-6551 covers multiple local file inclusion/traversal flaws in e-Vision CMS 2.0.2 and earlier, exploited when magic_quotes_gpc is disabled. An attacker can trigger directory traversal via (1) an adminlang cookie to admin/ind_ex.php or (2) various module parameters to adminpart/add*.php in ...

CVE-2007-3214

The CVE-2007-3214 entry affects e-Vision CMS versions 2.02 and earlier, with the vulnerability in style.php. When magic_quotes_gpc is disabled, the template parameter can be exploited to perform SQL injection, allowing remote attackers to execute arbitrary SQL commands. This is a direct impact on...

CVE-2006-5017

CVE-2006-5017 corresponds to a SQL injection vulnerability in Szava Gyula and Csaba Tamas e-Vision CMS, affecting the admin/all_users.php component. The issue allows remote attackers to inject arbitrary SQL commands through the from parameter, enabling potential data disclosure or modification. P...

CVE-2008-0856

The CVE-2008-0856 entry documents multiple SQL injection vulnerabilities in e-Vision CMS 2.02, where remote attackers can inject arbitrary SQL via the id parameter to iframe.php and print.php. The issue affects the application’s data handling in these two endpoints, enabling potential unauthorize...

CVE-2007-3251

The CVE-2007-3251 entries describe directory traversal vulnerabilities in e-Vision CMS (version 2.02 and earlier). The issues allow remote attackers to (1) include and execute arbitrary local files via a dot-dot in the adminlang cookie to admin/functions.php, and (2) read arbitrary local files vi...