CVE-2008-2497

CVE-2008-2497 affects Mambo prior to 4.6.4, with a CRLF injection vulnerability that lets remote attackers inject arbitrary HTTP headers and perform HTTP response splitting via unspecified vectors. The connected documents confirm the affected software and the underlying CRLF issue, but do not pro...

CVE-2006-1957

The CVE-2006-1957 entry affects the com_rss option (rss.php) in Mambo and Joomla!. The vulnerability allows remote attackers to trigger a denial of service (disk consumption and potentially web-server outage) by issuing multiple requests with different values of the feed parameter. Public referen...

CVE-2008-7212

The CVE-2008-7212 vulnerability affects MOStlyCE before 2.4 used with Mambo 4.6.3 and earlier. It allows remote attackers to trigger error messages via requests to mambots/editors/mostlyce/jscripts/tiny_mce/filemanager/connectors/php/connector.php, revealing the installation path. No exploitation...

CVE-2011-3754

CVE-2011-3754 affects Mambo 4.6.5. The vulnerability allows information disclosure via a direct request to a PHP file, where an error message reveals the installation path (e.g., includes/sef.php). Impact is partial confidentiality loss. The technical details do not specify a patch or workaround ...

CVE-2008-7215

The CVE-2008-7215 entry concerns MOStlyCE (MOStlyContent Editor) as used in Mambo 4.6.3 and earlier. The Image Manager of MOStlyCE before version 2.4 allows remote attackers to rename arbitrary files and trigger a denial of service by sending modified file[NewFile][name], file[NewFile][tmp_name],...

CVE-2008-7213

CVE-2008-7213 describes an XSS vulnerability in MOStlyCE (used with Mambo 4.6.3 and earlier) via the Command parameter in the PHP connector for TinyMCE filemanager (path: mambots/editors/mostlyce/jscripts/tiny_mce/filemanager/connectors/php/connector.php). The issue arises in MOStlyCE before vers...

CVE-2011-2917

CVE-2011-2917 describes a SQL injection vulnerability in Mambo CMS

CVE-2008-7214

The CVE-2008-7214 entry describes a CSRF flaw in MOStlyCE before 2.4 (used in Mambo 4.6.3 and earlier) affecting administrator/index2.php. The vulnerability lets remote attackers hijack an administrator’s session to add new administrator accounts via the save task in a com_users action, with the ...

CVE-2008-2498

CVE-2008-2498 involves multiple SQL injection vulnerabilities in Mambo before 4.6.4. The flaws allow remote attackers to execute arbitrary SQL commands via the articleid and mcname parameters in index.php when magic_quotes_gpc is disabled. The issue is documented across multiple sources (NVD/NVD-...