CVE-2017-15875

CVE-2017-15875 documents a SQL injection vulnerability in GPWeb Password Recovery, version 8.4.61. The vulnerability allows remote attackers to execute arbitrary SQL commands via the checkemail parameter. Connected sources confirm the affected product/version and the injection vector, but do not ...

CVE-2017-15877

The CVE-2017-15877 entry concerns GPWeb 8.4.61, where an Insecure Permissions issue in db.php allows remote attackers to view password and user databases. This is supported by multiple connected records (NVD entry and CNVD/PRION/CVELIST variants) referencing GPWeb 8.4.61 and information disclosur...

CVE-2017-15876

GPWeb 8.4.61 is affected by an Unrestricted File Upload vulnerability allowing remote authenticated users to upload arbitrary files, including PHP shells. Multiple sources (NVD/CNVD/PRION/CVELIST) confirm the flaw exists in GPWeb 8.4.61 and enable uploading of unauthenticated? No—explicitly state...