CVE-2008-4428

CVE-2008-4428 affects Phlatline’s Personal Information Manager (pPIM) 1.0 and earlier. Unrestricted file upload in upload.php allows remote attackers to upload a .php file and execute it by requesting the file in the top‑level directory, enabling remote code execution (CVSSv2 base score 10.0, HIG...

CVE-2008-4425

CVE-2008-4425 concerns Phlatline’s Personal Information Manager (pPIM) 1.0. The vulnerability is a directory traversal issue in upload.php (action delfile) that allows a remote attacker to delete arbitrary files by manipulating the file parameter. Documented impact includes the ability to delete ...

CVE-2008-4528

CVE-2008-4528 affects Phlatline’s Personal Information Manager (pPIM) 1.01. The issue is a directory traversal in notes.php where an attacker can cause inclusion and execution of arbitrary local files by supplying a ".." in the id parameter during an edit action. This relies on improper handling ...

CVE-2008-4426

Phlatline's Personal Information Manager (pPIM) 1.0 contains a Cross-site Scripting (XSS) vulnerability in events.php. The flaw allows remote attackers to inject arbitrary web script or HTML via the date parameter in a new action. This is documented under CVE-2008-4426; multiple connected sources...

CVE-2008-4427

CVE-2008-4427 affects Phlatline’s Personal Information Manager (pPIM) up to version 1.0. The vulnerability is that changepassword.php does not require administrative authentication, enabling remote attackers to change arbitrary user passwords. This is the explicitly described impact in the CVE en...