8 matches found
CVE-2007-3428
CVE-2007-3428 describes multiple unspecified vulnerabilities in phpTrafficA before 1.4.2 that allow remote attackers to influence the application via the file parameter to plotStatBar.php or plotStatPie.php. The initial entry notes the impact as unknown and does not specify exploit vectors or aff...
CVE-2007-3425
CVE-2007-3425 is a directory traversal vulnerability in phpTrafficA 1.4.2 and earlier. An attacker can cause Local File Inclusion by manipulating the lang parameter in index.php, allowing remote access to arbitrary local files. The root cause is unsafe handling of the lang parameter leading to in...
CVE-2015-2926
The CVE-2015-2926 entry concerns phpTrafficA up to version 2.3, where the user-supplied HTTP User-Agent string is not sanitized before being echoed in the Latest visitors Details page (Php/stats/statsRecent.inc.php). This causes a reflected XSS vulnerability (HTML/JS injection) when the page outp...
CVE-2007-3647
CVE-2007-3647 affects phpTrafficA 1.4.3 and earlier. The isloggedin() function in Php/login.inc.php permits remote bypass of authentication by setting the username cookie to "traffic", thereby gaining administrative access. No remediation details are provided in the supplied documents.
CVE-2007-3426
The CVE-2007-3426 issue affects phpTrafficA (versions 1.4.2 and earlier). The vulnerability is an XSS in index.php where the lang parameter can be exploited to inject arbitrary web script or HTML. This could allow remote attackers to run client-side code in the context of the affected user’s sess...
CVE-2007-3427
Affected software: phpTrafficA 1.4.2 and earlier. The vulnerability is in index.php (stats action) where the pageid parameter enables SQL injection, allowing remote attackers to execute arbitrary SQL commands. Root cause: improper handling/validation of pageid leading to injection. Impact: as sta...
CVE-2006-7209
CVE-2006-7209 describes multiple cross-site scripting (XSS) vulnerabilities in phpTrafficA before version 1.2beta2 . The issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to keywords, affecting the application's pages for main, daily, weekly, mon...