CVE-2009-0535

CVE-2009-0535 describes a directory traversal in export.php of Thyme 1.3 and earlier, where, when register_globals is disabled, an attacker can read arbitrary files by supplying a .. in the export_to parameter. The NVD entry scores this as 7.5/10 (HIGH) with network access, low attack complexity,...

CVE-2008-6404

CVE-2008-6404 is a documented cross-site scripting (XSS) vulnerability in add_calendars.php of eXtrovert Software Thyme 1.3, exploitable via the callback parameter. Multiple sources (NVD, CVE listings) corroborate that remote attackers can inject arbitrary web script or HTML. The NVD entry assign...

CVE-2006-2117

CVE-2006-2117 affects Thyme 1.3 with a cross-site scripting (XSS) vulnerability exposed via the search page. The NVD entry confirms an XSS issue allowing remote script/HTML injection; no details on affected versions beyond Thyme 1.3 are provided in the connected documents. There is no explicit re...