CVE-2004-1504

The CVE concerns Just Another Flat File (JAF) CMS 3.0RC. The vulnerability is in the displaycontent function of config.php, which allows remote attackers to gain sensitive information by supplying a blank show parameter; an error message reveals the installation path (demonstrated with index.php)...

CVE-2004-1505

Technical details (affected product/component/versions/root cause) are not publicly provided in the supplied Connected documents. Monitor for updates to confirm scope, impact, and remediation for CVE-2004-1505.

CVE-2006-5131

CVE-2006-5131 affects ph03y3nk Just Another Flat File (JAF) CMS 4.0 RC1. The vulnerability is in module/shout/jafshout.php (the shoutbox), where remote attackers could execute arbitrary code within sections bounded by "". This is described as potentially due to a static code injection vulnerabili...

CVE-2005-2053

CVE-2005-2053 affects Just another flat file (JAF) CMS prior to 3.0 Final. The vulnerability exposes sensitive information through error messages when (1) an asterisk in the id parameter, (2) a blank id parameter, or (3) an asterisk in the disp parameter to index.php is used, potentially revealin...

CVE-2006-5130

CVE-2006-5130 describes multiple XSS vulnerabilities in the ph03y3nk just another flat file (JAF) CMS 4.0 RC1 . The flaws allow remote attackers to inject arbitrary web script or HTML via the forum post parameters: name, url, title, and about . The underlying product is a flat-file CMS, and the d...

CVE-2006-5129

CVE-2006-5129 affects ph03y3nk just another flat file (JAF) CMS 4.0 RC1. The vulnerabilities are cross-site scripting in two spots: (1) module/shout/jafshout.php (the shoutbox) via the message parameter and related name/email/title/date/ldate/lname variables, and (2) the message body in a forum p...

CVE-2007-6142

The CVE affects ph03y3nk just another flat file (JAF) CMS 4.0 RC2. It describes reflected Cross‑Site Scripting via the index.php show parameter and the print.php print parameter, enabling injection of arbitrary web script/HTML. The root cause is input handling in these two parameters leading to s...

CVE-2006-7127

CVE-2006-7127 affects the JAF CMS (versions 4.0 and 4.0 RC2). Affected component: the forum/ directory handling pages (forum/main.php and forum/headlines.php). Root cause: remote PHP code execution via a crafted URL passed to the main_dir parameter, enabling an attacker to include and run arbitra...

CVE-2006-7128

CVE-2006-7128 describes a PHP remote file inclusion in JAF CMS 4.0 RC1, exploitable via the URL in the website parameter of forum.php, allowing remote code execution. The NVD CVSSv2 base score is 7.5 (HIGH) with network access, low complexity, no authentication, and partial impact on confidential...