CVE-2009-1614

CVE-2009-1614 refers to multiple cross-site scripting (XSS) vulnerabilities in Leap CMS 0.1.4, allowing remote attackers to inject arbitrary web script or HTML via the msg parameter (article comment message) or the searchterm parameter (search form). The vulnerability details come from multiple s...

CVE-2009-1613

Leap CMS 0.1.4 is affected by SQL injection in leap.php via the (1) searchterm and (2) email parameters when magic_quotes_gpc is disabled. The core issue is improper input handling in Leap CMS, enabling remote attackers to execute arbitrary SQL. Impact is partial confidentiality, integrity, and a...

CVE-2009-1615

CVE-2009-1615 affects Leap CMS 0.1.4. It is an unrestricted file upload vulnerability allowing remote attackers to execute arbitrary code by uploading a file with an executable extension through admin.system.files (Manage Files) to the default URI, then accessing it directly. CVSSv2 base score ~6...