CVE-2002-2290

CVE-2002-2290 affects Mambo Site Server 4.0.11, where a default username/password of admin enables remote attackers to gain privileges. The description across sources repeats that a default credential leads to privilege escalation, but no concrete exploit vectors or patched versions are provided ...

CVE-2002-2247

The CVE-2002-2247 entry concerns Mambo Site Server 4.0.11 where the administrator/phpinfo.php script calls phpinfo(), enabling remote attackers to reveal sensitive information such as the full web root path. This is an information-disclosure flaw attributed to phpinfo() usage in that script. The ...

CVE-2001-1011

The vulnerability affects Mambo Site Server versions 3.0.0–3.0.5 in index2.php. A flaw in session handling (PHPSESSID) allows remote attackers to gain Mambo administrator privileges by supplying the proper administrator parameters alongside the PHPSESSID. The provided sources consistently describ...

CVE-2005-3738

CVE-2005-3738 affects Mambo Site Server 4.0.14 and earlier. When register_globals is disabled, globals.php can be manipulated to overwrite the GLOBALS array, enabling remote attackers to trigger various attacks, including a remote PHP file inclusion demonstrated via mosConfig_absolute_path in con...

CVE-2003-1203

CVE-2003-1203 affects Mambo Site Server 4.0.10. A cross-site scripting vulnerability exists in index.php via the ?option parameter, enabling remote attackers to run script in other clients. OpenVAS entries document the XSS issue; NVD/NVD-derived entries confirm the same. No remediation or fix ver...

CVE-2007-4745

AkoBook 3.42 and earlier (component com_akobook) for Mambo contain multiple cross-site scripting (XSS) vulnerabilities. The issue arises in the sign function, where attacker-controlled Javascript events in the parameters (gbmail and gbpage) can be injected to execute scripts in the victim’s brows...

CVE-2002-1662

CVE-2002-1662 corresponds to multiple cross-site scripting (XSS) vulnerabilities in Mambo Site Server 4.0.11. The issues allow remote attackers to execute arbitrary script on other clients via (1) search.php and (2) the "Your name" field during account registration. This is described in the NVD e...