CVE-2006-4422

CVE-2006-4422 describes a PHP remote file inclusion in Jetbox CMS 2.1. The vulnerability affects includes/phpdig/libs/search_function.php via a URL in the relative_script_path parameter, enabling arbitrary PHP code execution. This CVE is noted as having a vector different from CVE-2006-2270 and i...

CVE-2007-1898

Jetbox CMS 2.1 contains a vulnerability in formmail.php allowing remote attackers to trigger email injection by modifying the recipient, _SETTINGS[allowed_email_hosts][], and subject parameters. The issue is corroborated by multiple sources (NVD CVE-2007-1898 and NetVigilance advisories) and is d...

CVE-2006-2270

CVE-2006-2270 : Jetbox CMS 2.1 has a PHP remote file inclusion in includes/config.php that allows an attacker to execute arbitrary PHP code by providing a URL in the relative_script_path parameter. The documents do not provide exploitation details or a published patch in the supplied material. Re...

CVE-2007-2685

Jetbox CMS 2.1 has SQL injection vulnerabilities in index.php via the view and login parameters, allowing remote attackers to execute arbitrary SQL commands. Root cause: improper handling of input in Jetbox CMS 2.1 leads to injectable SQL. Exploitation is described as remote with no authenticatio...

CVE-2008-4651

CVE-2008-4651 affects Jetbox CMS 2.1 with multiple SQL injection vulnerabilities that allow remote authenticated users to execute arbitrary SQL commands. The issues are triggered via (1) the orderby parameter to admin/cms/images.php and (2) the nav_id parameter in an editrecord action to admin/cm...

CVE-2006-3583

CVE-2006-3583 describes a session- fixation vulnerability in Jetbox CMS 2.1 SR1 . The root cause involves login/session handling flaws and unsanitised input in server-side scripts (notably in index.php and admin/cms/index.php), enabling an attacker to hijack a user’s session via a crafted link an...

CVE-2007-2684

Jetbox CMS 2.1 is affected by multiple information-disclosure vectors. The vulnerability arises from (1) direct requests to main_page.php, open_tree.php, and outputs.php, (2) a malformed view parameter to index.php enabling SQL-injection-like manipulation, and (3) the id[] parameter pass-through ...

CVE-2006-3585

CVE-2006-3585 describes multiple cross-site scripting (XSS) vulnerabilities in Jetbox CMS 2.1 SR1. Affected components include: the login parameter in admin/cms/index.php; parameters on the Supply news page in formmail.php; the URL in the Site statistics page; and the query_string parameter when ...

CVE-2007-2731

Jetbox CMS 2.1 is affected by a CRLF injection in formmail.php, allowing remote attackers to inject arbitrary e-mail headers via LF sequences in the subject parameter. This is linked to CVE-2007-1898. The NetVigilance advisory notes that exploitation requires PHP register_globals to be On; a work...

CVE-2006-4739

Jetbox CMS contains multiple XSS vulnerabilities that allow remote attackers to inject arbitrary web script or HTML. The issue is demonstrated via the OriginalImageData parameter to phpthumb.php, as described across CVE-2006-4739 records. The available documents do not provide exploit details, af...

CVE-2006-3584

CVE-2006-3584 affects Jetbox CMS 2.1 SR1. The vulnerability is in index.php where inputs passed in the URL are evaluated as PHP variable variables, allowing remote attackers to overwrite configuration variables. This is caused by improper handling/sanitization of URL parameters and can lead to di...

CVE-2006-4738

CVE-2006-4738 describes a PHP remote file inclusion in Jetbox CMS, specifically in phpthumb.php, allowing an attacker to execute arbitrary PHP code via a URL supplied to the includes_path parameter. The entry notes that the related relative_script_path vector is already covered by CVE-2006-2270. ...

CVE-2007-2732

CVE-2007-2732 describes multiple cross-site scripting (XSS) vulnerabilities in Jetbox CMS. Remote attackers can inject arbitrary web script or HTML via the (1) path parameter to view/search/ and (2) through parameters in view/supplynews/ such as companyname, country, email, firstname, middlename,...

CVE-2007-2733

CVE-2007-2733 is an unrestricted file upload vulnerability in Jetbox CMS, where remote authenticated users with author privileges can upload arbitrary scripts (e.g., PHP) via the IMAGES/webfiles mechanism and execute code. Public details indicate Jetbox One 2.0.8 and other versions are affected, ...

CVE-2008-6174

CVE-2008-6174 is an XSS vulnerability affecting Jetbox CMS 2.1, specifically in admin/postlister/index.php where the liste parameter can be exploited to inject arbitrary web script or HTML. The descriptions across NVD and related records confirm a cross-site scripting flaw without details on obse...

CVE-2007-2686

CVE-2007-2686 describes a Cross‑Site Scripting (XSS) vulnerability in Jetbox CMS 2.1. The flaw is in index.php, where an attacker can inject arbitrary web script or HTML via the login parameter in the sendpwd task. Affected product: Jetbox CMS 2.1. Reported impact per sources is XSS with potentia...

CVE-2006-3586

Jetbox CMS 2.1 SR1 is affected by CVE-2006-3586 due to unsanitized input leading to SQL injection in index.php (frontsession cookie and view parameter) and in admin/cms/index.php (login parameter). Exploitation could allow remote attackers to execute arbitrary SQL commands, potentially impacting ...

CVE-2006-4737

Jetbox CMS contains an SQL injection in index.php via the item parameter, allowing remote injection of arbitrary web content. The description notes that the view-vector is already covered by CVE-2006-3586, indicating a related vulnerability in the same package. Root cause: unsanitized input used ...

CVE-2006-4740

CVE-2006-4740 affects Jetbox CMS. The vulnerability allows remote attackers to obtain sensitive information by directly requesting certain files, exposing the server file path in error messages. Public references (NVD) indicate a partial confidentiality impact with network access and low attack c...