deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2011-3794
Published: 2011-09-24
Description: Pligg CMS 1.1.3 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by widgets/statistics/init.php and certain other files.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README; http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/PliggCMS1.1.3; http://www.openwall.com/lists/oss-security/2011/06/27/6
CVE: CVE-2011-3795
Published: 2011-09-24
Description: Podcast Generator 1.3 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by core/themes.php and certain other files.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README; http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/podcastgen1.3; http://www.openwall.com/lists/oss-security/2011/06/27/6
CVE: CVE-2011-3796
Published: 2011-09-24
Description: PrestaShop 1.4.0.6 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by product-sort.php and certain other files.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README; http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/prestashop_1.4.0.6; http://www.openwall.com/lists/oss-security/2011/06/27/6
CVE: CVE-2011-3797
Published: 2011-09-24
Description: ProjectPier 0.8.0.3 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by public/upgrade/templates/layout.php and certain other files.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README; http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/projectpier-0.8.0.3; http://www.openwall.com/lists/oss-security/2011/06/27/6
CVE: CVE-2011-3798
Published: 2011-09-24
Description: Rapid Leech 2.3-v42-svn322 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by classes/pear.php and certain other files.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README; http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/rapidleech-2.3-v42-svn322; http://www.openwall.com/lists/oss-security/2011/06/27/6
CVE: CVE-2011-3799
Published: 2011-09-24
Description: ReOS 2.0.5 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by padmin/blocks/vergal.php and certain other files.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README; http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/ReOS_v2_0_5; http://www.openwall.com/lists/oss-security/2011/06/27/6
CVE: CVE-2011-3800
Published: 2011-09-24
Description: Serendipity 1.5.5 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by templates/newspaper/layout.php and certain other files.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README; http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/serendipity-1.5.5; http://www.openwall.com/lists/oss-security/2011/06/27/6
CVE: CVE-2011-3801
Published: 2011-09-24
Description: SimpleTest 1.0.1 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by test/visual_test.php and certain other files.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README; http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/simpletest-1.0.1; http://www.openwall.com/lists/oss-security/2011/06/27/6
CVE: CVE-2011-3802
Published: 2011-09-24
Description: StatusNet 0.9.6 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by tpl/index.php and certain other files.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README; http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/statusnet-0.9.6; http://www.openwall.com/lists/oss-security/2011/06/27/6
CVE: CVE-2011-3803
Published: 2011-09-24
Description: SugarCRM 6.1.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by themes/Sugar5/layout_utils.php and certain other files.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README; http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/SugarCRM-6.1.0; http://www.openwall.com/lists/oss-security/2011/06/27/6
CVE: CVE-2011-3804
Published: 2011-09-24
Description: SweetRice 0.7.1 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by _plugin/tiny_mce/plugins/advimage/images.php.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README; http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/sweetrice-0.7.1; http://www.openwall.com/lists/oss-security/2011/06/27/6
CVE: CVE-2011-3805
Published: 2011-09-24
Description: TaskFreak! multi-mysql-0.6 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by include/language/zh/register_info.php and certain other files.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README; http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/taskfreak-multi-mysql-0.6; http://www.openwall.com/lists/oss-security/2011/06/27/6
CVE: CVE-2011-3806
Published: 2011-09-24
Description: TCExam 11.1.015 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by public/code/tce_page_footer.php and certain other files.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README; http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/tcexam_11.1.015; http://www.openwall.com/lists/oss-security/2011/06/27/6
CVE: CVE-2011-3807
Published: 2011-09-24
Description: Textpattern 4.2.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by lib/txplib_db.php and certain other files.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README; http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/textpattern-4.2.0; http://www.openwall.com/lists/oss-security/2011/06/27/6
CVE: CVE-2011-3808
Published: 2011-09-24
Description: The Bug Genie 2.1.2 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by modules/svn_integration/config.inc.php and certain other files.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README; http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/thebuggenie_2.1.2; http://www.openwall.com/lists/oss-security/2011/06/27/6
CVE: CVE-2011-3809
Published: 2011-09-24
Description: TheHostingTool (THT) 1.2.3 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by includes/pear/Mail/smtp.php and certain other files.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README; http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/theHostingTool-v1.2.3; http://www.openwall.com/lists/oss-security/2011/06/27/6
CVE: CVE-2011-3810
Published: 2011-09-24
Description: TinyWebGallery (TWG) 1.8.3 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by i_frames/i_register.php.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README; http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/TinyWebGallery-1.8.3; http://www.openwall.com/lists/oss-security/2011/06/27/6
CVE: CVE-2011-3811
Published: 2011-09-24
Description: TomatoCart 1.1.3 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by templates/system/offline.php and certain other files.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README; http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/tomatocart-1.1.3; http://www.openwall.com/lists/oss-security/2011/06/27/6
CVE: CVE-2011-3812
Published: 2011-09-24
Description: Vanilla 2.0.16 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by plugins/Minify/min/utils.php and certain other files.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README; http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/vanilla-2.0.16; http://www.openwall.com/lists/oss-security/2011/06/27/6
CVE: CVE-2011-3813
Published: 2011-09-24
Description: Virtual War (aka VWar) 1.5.0r15 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by includes/language/dutch.inc.php and certain other files.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README; http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/vwar-1.5.0r15; http://www.openwall.com/lists/oss-security/2011/06/27/6
CVE: CVE-2011-3814
Published: 2011-09-24
Description: WebCalendar 1.2.3, and other versions before 1.2.5, allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by ws/user_mod.php and certain other files.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README; http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/WebCalendar-1.2.3; http://webcalendar.cvs.sourceforge.net/viewvc/webcalendar/webcalendar/ChangeLog?pathrev=REL_1_2
CVE: CVE-2011-3815
Published: 2011-09-24
Description: WeBid 1.0.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by js/calendar.php and certain other files.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README; http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/WeBid-1.0.0; http://www.openwall.com/lists/oss-security/2011/06/27/6
CVE: CVE-2011-3816
Published: 2011-09-24
Description: WEBinsta mailing list manager 1.3e allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by install/install3.php and certain other files.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README; http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/webinsta-mail-list-1.3e; http://www.openwall.com/lists/oss-security/2011/06/27/6
CVE: CVE-2011-3817
Published: 2011-09-24
Description: Website Baker 2.8.1 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by admin/media/parameters.php and certain other files.  NOTE: this might overlap CVE-2005-2436.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README; http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/WebsiteBaker_2.8.1; http://www.openwall.com/lists/oss-security/2011/06/27/6
CVE: CVE-2011-3818
Published: 2011-09-24
Description: WordPress 2.9.2 and 3.0.4 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by wp-admin/includes/user.php and certain other files.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README; http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/wordpress_2.9.2; http://www.openwall.com/lists/oss-security/2011/06/27/6
CVE: CVE-2011-3819
Published: 2011-09-24
Description: WoW Server Status 4.1 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by status.php and certain other files.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README; http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/WoW-Server-Status_4.1; http://www.openwall.com/lists/oss-security/2011/06/27/6
CVE: CVE-2011-3820
Published: 2011-09-24
Description: WSN Software 6.0.6 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by includes/prestart.php and certain other files.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README; http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/WSN_Software_6.0.6; http://www.openwall.com/lists/oss-security/2011/06/27/6
CVE: CVE-2011-3821
Published: 2011-09-24
Description: xajax 0.6 beta1 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by xajax_core/plugin_layer/xajaxScriptPlugin.inc.php and certain other files.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README; http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/xajax; http://www.openwall.com/lists/oss-security/2011/06/27/6
CVE: CVE-2011-3822
Published: 2011-09-24
Description: XOOPS 2.5.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by modules/system/xoops_version.php and certain other files.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README; http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/xoops-2.5.0; http://www.openwall.com/lists/oss-security/2011/06/27/6
CVE: CVE-2011-3823
Published: 2011-09-24
Description: Yamamah 1.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by themes/default/index.php and certain other files.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README; http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/yamamah_1.0; http://www.openwall.com/lists/oss-security/2011/06/27/6
CVE: CVE-2011-3824
Published: 2011-09-24
Description: Your Own URL Shortener (YOURLS) 1.5 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by includes/auth.php and certain other files.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README; http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/yourls-1.5; http://www.openwall.com/lists/oss-security/2011/06/27/6
CVE: CVE-2011-3825
Published: 2011-09-24
Description: Zend Framework 1.11.3 in Zend Server CE 5.1.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by Validate.php and certain other files.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README; http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/Zend; http://www.openwall.com/lists/oss-security/2011/06/27/6
CVE: CVE-2011-3826
Published: 2011-09-24
Description: Zikula 1.2.4 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by themes/voodoodolly/version.php and certain other files.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README; http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/zikula-1.2.4; http://www.openwall.com/lists/oss-security/2011/06/27/6
CVE: CVE-2004-2770
Published: 2011-09-25
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2011-3389.  Reason: This candidate is a duplicate of CVE-2011-3389.  Notes: All CVE users should reference CVE-2011-3389 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2010-4842
Published: 2011-09-27
Description: SQL injection vulnerability in admin/login.php in MHP DownloadScript (aka MH Products Download Center) 2.2 allows remote attackers to execute arbitrary SQL commands via the Name parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/42714; http://www.exploit-db.com/exploits/15770; http://www.securityfocus.com/bid/45494
CVE: CVE-2010-4843
Published: 2011-09-27
Description: SQL injection vulnerability in website-page.php in PHP Web Scripts Ad Manager Pro 3.0 allows remote attackers to execute arbitrary SQL commands via the pageId parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/files/view/96822/phpwsamp-sql.txt; http://securityreason.com/securityalert/8395; http://www.exploit-db.com/exploits/15790
CVE: CVE-2010-4844
Published: 2011-09-27
Description: SQL injection vulnerability in content.php in MH Products Easy Online Shop allows remote attackers to execute arbitrary SQL commands via the kat parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/files/view/96780/easyonlineshop-sql.txt; http://secunia.com/advisories/42680; http://securityreason.com/securityalert/8396
CVE: CVE-2010-4845
Published: 2011-09-27
Description: Multiple SQL injection vulnerabilities in MH Products Projekt Shop allow remote attackers to execute arbitrary SQL commands via the (1) ts parameter to details.php and possibly the (2) ilceler parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/42711; http://www.exploit-db.com/exploits/15773; http://www.securityfocus.com/bid/45506
CVE: CVE-2010-4846
Published: 2011-09-27
Description: SQL injection vulnerability in view_item.php in MH Products Pay Pal Shop Digital allows remote attackers to execute arbitrary SQL commands via the ItemID parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/42712; http://www.exploit-db.com/exploits/15772; http://www.securityfocus.com/bid/45495
CVE: CVE-2010-4847
Published: 2011-09-27
Description: SQL injection vulnerability in view_item.php in MH Products MHP Downloadshop allows remote attackers to execute arbitrary SQL commands via the ItemID parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/files/view/96774/mhpdownloadshop-sql.txt; http://secunia.com/advisories/42675; http://securityreason.com/securityalert/8397
CVE: CVE-2010-4848
Published: 2011-09-27
Description: Multiple cross-site scripting (XSS) vulnerabilities in addlink.php in AXScripts AxsLinks 0.3 allow remote attackers to inject arbitrary web script or HTML via the (1) url or (2) title parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://evuln.com/vulns/139/summary.html; http://packetstormsecurity.org/files/view/96006/axslinks-xss.txt; http://www.securityfocus.com/archive/1/514843/100/0/threaded
CVE: CVE-2010-4849
Published: 2011-09-27
Description: SQL injection vulnerability in countrydetails.php in Alibaba Clone B2B 3.4 allows remote attackers to execute arbitrary SQL commands via the es_id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/15650; http://www.securityfocus.com/bid/45130; http://www.exploit-db.com/exploits/15650
CVE: CVE-2010-4850
Published: 2011-09-27
Description: Multiple cross-site scripting (XSS) vulnerabilities in Diferior 8.03 allow remote attackers to inject arbitrary web script or HTML via the (1) post_content parameter to post/edit/2/p1.html, related to views/post.php; the (2) slogan parameter to admin/site/2.html, related to views/admin.php; or the (3) subcatname or (4) description parameter to admin/forum/create_sub.html, related to views/admin.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/files/view/96207/diferior-xss.txt; http://securityreason.com/securityalert/8398; http://www.exploit-db.com/exploits/15633
CVE: CVE-2010-4851
Published: 2011-09-27
Description: Multiple SQL injection vulnerabilities in Eclime 1.1.2b allow remote attackers to execute arbitrary SQL commands via the (1) ref or (2) poll_id parameter to index.php, or the (3) country parameter to create_account.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/files/view/96228/eclime112b-sql.txt; http://securityreason.com/securityalert/8399; http://www.exploit-db.com/exploits/15644
CVE: CVE-2010-4852
Published: 2011-09-27
Description: Cross-site scripting (XSS) vulnerability in login.php in Eclime 1.1.2b allows remote attackers to inject arbitrary web script or HTML via the reason parameter in a fail action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/files/view/96228/eclime112b-sql.txt; http://securityreason.com/securityalert/8399; http://www.exploit-db.com/exploits/15644