2 matches found
CVE-2012-5892
Havalite CMS 1.1.0 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the configuration database via a direct request for data/havalite.db3.
CVE-2013-0161
Havalite CMS 1.1.7 has a stored XSS vulnerability