CVE-2006-3850

Vanilla CMS 1.0.1 and earlier contains a remote file inclusion vulnerability in upgrader.php when /conf/old_settings.php exists. An attacker can dereference a URL in the RootDirectory parameter to execute arbitrary PHP code. The issue has been disputed for version 1.0 (some sources state the Root...

CVE-2007-5643

CVE-2007-5643 describes multiple SQL injection vulnerabilities in Lussumo Vanilla 1.1.3 and earlier, allowing remote attackers to execute arbitrary SQL commands. The affected vectors are (1) the CategoryID parameter to ajax/sortcategories.php and (2) an unspecified vector to ajax/sortroles.php. T...

CVE-2010-1337

Summary: CVE-2010-1337 affects Lussumo Vanilla (definitions.php) and enables remote PHP code execution through remote file inclusion in two parameters: include and Configuration['LANGUAGE']. It is stated for Vanilla 1.1.10 and possibly earlier versions (0.9.2 and others). What is affected: Lussum...

CVE-2007-5644

Lussumo Vanilla 1.1.3 and earlier allows remote unauthenticated users to perform unauthorized operations through two AJAX endpoints (ajax/sortcategories.php and ajax/sortroles.php) due to missing admin-privilege checks. Affected component: Vanilla CMS PHP backend; root cause: no authorization on ...

CVE-2008-3759

CVE-2008-3759 is a Cross-site Request Forgery (CSRF) vulnerability in Vanilla up to version 1.1.4, affecting ajax/UpdateCheck.php. The impact is described as unknown in the initial descriptions, with a CVSSv2 base score of 7.5 (NETWORK attack, LOW attack complexity, no authentication, partial con...

CVE-2009-1845

CVE-2009-1845 describes a cross-site scripting (XSS) vulnerability in Lussumo Vanilla specifically in ajax/updatecheck.php, affecting Vanilla 1.1.5 and 1.1.7. The underlying issue is that the RequestName parameter can be exploited to inject arbitrary web script or HTML. Connected sources (OpenVAS...

CVE-2008-3874

CVE-2008-3874 describes a cross-site scripting (XSS) vulnerability in the Vanilla forum software. Affected product/version: Vanilla 1.1.5-rc1, 1.1.4, and earlier; vulnerable component: the file account.php . The underlying issue is an XSS flaw that allows remote authenticated users to inject arbi...

CVE-2008-3760

The CVE-2008-3760 entry documents a CSRF flaw in Vanilla CMS prior to and including version 1.1.4, located on the sign-out page. The vulnerability lets remote attackers hijack a user’s authenticated session by triggering a logout via a SignOutNow request to people.php, with no user interaction re...

CVE-2008-3758

CVE-2008-3758 involves multiple XSS vulnerabilities in Lussumo Vanilla 1.1.4 and earlier. The affected application is the Lussumo Vanilla content management system. The issues allow remote attackers to inject arbitrary web script or HTML via the NewPassword parameter to people.php , and allow rem...