deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2009-4472
Published: 2009-12-30
Description: Multiple PHP remote file inclusion vulnerabilities in PHPope 1.0.0 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the (1) GLOBALS[config][dir][plugins] parameter to plugins/address/admin/index.php, (2) GLOBALS[config][dir][functions] parameter to plugins/im/compose.php, and (3) GLOBALS[config][dir][classes] parameter to plugins/cssedit/admin/index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.exploit-db.com/exploits/9583; http://www.vupen.com/english/advisories/2009/2536; https://exchange.xforce.ibmcloud.com/vulnerabilities/53018
CVE: CVE-2009-4473
Published: 2009-12-30
Description: Multiple cross-site scripting (XSS) vulnerabilities in WorkArea/ContentDesigner/ekformsiframe.aspx in Ektron CMS400.NET 7.6.1.53 and 7.6.6.47, and possibly 7.52 through 7.66sp2, allow remote attackers to inject arbitrary web script or HTML via the (1) css, (2) eca, (3) id, and (4) skin parameters.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://dev.ektron.com/forum.aspx?g=posts&t=28048; http://dev.ektron.com/notices.aspx?id=19074; http://osvdb.org/57667
CVE: CVE-2009-4474
Published: 2009-12-30
Description: SQL injection vulnerability in the Mike de Boer zoom (com_zoom) component 2.0 for Mambo allows remote attackers to execute arbitrary SQL commands via the catid parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/9588; http://www.securityfocus.com/bid/36281; http://www.exploit-db.com/exploits/9588
CVE: CVE-2009-4475
Published: 2009-12-30
Description: SQL injection vulnerability in the Joomlub (com_joomlub) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the aid parameter in an auction edit action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/0909-exploits/joomlajoomlub-sql.txt; http://secunia.com/advisories/36607; http://www.exploit-db.com/exploits/9593
CVE: CVE-2009-4476
Published: 2009-12-30
Description: Stack-based buffer overflow in HAURI ViRobot Desktop 5.5 before 2009-09-28.00 allows remote attackers to execute arbitrary code via unspecified vectors, as demonstrated by a certain module in VulnDisco Pack Professional 7.15 through 8.11.  NOTE: some of these details are obtained from third party information.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://intevydis.com/vd-list.shtml; http://secunia.com/advisories/36512; http://www.securityfocus.com/bid/36241
CVE: CVE-2009-4477
Published: 2009-12-30
Description: SQL injection vulnerability in page.html in Xstate Real Estate 1.0 allows remote attackers to execute arbitrary SQL commands via the pid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/57670; http://secunia.com/advisories/36529; http://www.exploit-db.com/exploits/9565
CVE: CVE-2009-4478
Published: 2009-12-30
Description: Multiple cross-site scripting (XSS) vulnerabilities in Xstate Real Estate 1.0 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) home.html or (2) lands.html.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/57671; http://osvdb.org/57672; http://secunia.com/advisories/36529
CVE: CVE-2009-4479
Published: 2009-12-30
Description: LDAP3A.exe in MailSite 8.0.4 allows remote attackers to cause a denial of service (heap memory corruption and daemon crash) via unspecified vectors, as demonstrated by a certain module in VulnDisco Pack Professional 7.13 through 8.11.  NOTE: as of 20091229, this disclosure has no actionable information. However, because the VulnDisco Pack author is a reliable researcher, the issue is being assigned a CVE identifier for tracking purposes.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://intevydis.com/vd-list.shtml; http://secunia.com/advisories/36573; http://www.securityfocus.com/bid/36240
CVE: CVE-2009-4480
Published: 2009-12-30
Description: Buffer overflow in the web service in AzeoTech DAQFactory 5.77 might allow remote attackers to execute arbitrary code via unspecified vectors, as demonstrated by a certain module in VulnDisco Pack Professional 7.16 through 8.11.  NOTE: as of 20091229, this disclosure has no actionable information. However, because the VulnDisco Pack author is a reliable researcher, the issue is being assigned a CVE identifier for tracking purposes.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://intevydis.com/vd-list.shtml; http://secunia.com/advisories/36504; http://intevydis.com/vd-list.shtml
CVE: CVE-2009-4481
Published: 2009-12-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2009-3111.  Reason: This candidate is a duplicate of CVE-2009-3111.  Notes: All CVE users should reference CVE-2009-3111 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2009-4482
Published: 2009-12-30
Description: Buffer overflow in MediaServer.exe in TVersity 1.6 allows remote attackers to execute arbitrary code via unspecified vectors, as demonstrated by the vd_tversity module in VulnDisco Pack Professional 8.11.  NOTE: as of 20091229, this disclosure has no actionable information. However, because the VulnDisco Pack author is a reliable researcher, the issue is being assigned a CVE identifier for tracking purposes.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://intevydis.com/vd-list.shtml; http://osvdb.org/57761; http://secunia.com/advisories/36588
CVE: CVE-2009-4483
Published: 2009-12-30
Description: Unspecified vulnerability in LDAP3A.exe in MailSite 8.0.4 allows remote attackers to cause a denial of service (daemon crash) via unknown vectors, as demonstrated by a certain module in VulnDisco Pack Professional 7.13 through 8.11.  NOTE: as of 20091229, this disclosure has no actionable information. However, because the VulnDisco Pack author is a reliable researcher, the issue is being assigned a CVE identifier for tracking purposes.
CVSS Score: 5.0 (MEDIUM)
References: http://intevydis.com/vd-list.shtml; http://secunia.com/advisories/36573; http://www.securityfocus.com/bid/36240
CVE: CVE-2009-4484
Published: 2009-12-30
Description: Multiple stack-based buffer overflows in the CertDecoder::GetName function in src/asn.cpp in TaoCrypt in yaSSL before 1.9.9, as used in mysqld in MySQL 5.0.x before 5.0.90, MySQL 5.1.x before 5.1.43, MySQL 5.5.x through 5.5.0-m2, and other products, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption and daemon crash) by establishing an SSL connection and sending an X.509 client certificate with a crafted name field, as demonstrated by mysql_overflow1.py and the vd_mysql5 module in VulnDisco Pack Professional 8.11. NOTE: this was originally reported for MySQL 5.0.51a.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://archives.neohapsis.com/archives/dailydave/2010-q1/0002.html; http://bazaar.launchpad.net/~mysql/mysql-server/mysql-5.0/revision/2837.1.1; http://bugs.mysql.com/bug.php?id=50227
CVE: CVE-2008-7249
Published: 2009-12-30
Description: Buffer overflow in Squid Analysis Report Generator (Sarg) 2.2.3.1, and probably later, allows user-assisted remote attackers to execute arbitrary code via a long HTTP request method in a crafted access.log file, a different vulnerability than CVE-2008-1167.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://sourceforge.net/project/shownotes.php?release_id=581212; http://www.securityfocus.com/archive/1/489018/100/0/threaded; http://www.vupen.com/english/advisories/2008/0749
CVE: CVE-2008-7250
Published: 2009-12-30
Description: Cross-site scripting (XSS) vulnerability in Squid Analysis Report Generator (Sarg) 2.2.4 allows remote attackers to inject arbitrary web script or HTML via a JavaScript onload event in the User-Agent header, which is not properly handled when displaying the Squid proxy log. NOTE: this issue exists because of an incomplete fix for CVE-2008-1168.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/28668; http://sourceforge.net/project/shownotes.php?release_id=581509; http://www.vupen.com/english/advisories/2008/0750
CVE: CVE-2009-4498
Published: 2009-12-31
Description: The node_process_command function in Zabbix Server before 1.8 allows remote attackers to execute arbitrary commands via a crafted request.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-78
References: http://secunia.com/advisories/37740; http://www.openwall.com/lists/oss-security/2010/04/02/1; http://www.securityfocus.com/archive/1/508436/30/60/threaded
CVE: CVE-2009-4499
Published: 2009-12-31
Description: SQL injection vulnerability in the get_history_lastid function in the nodewatcher component in Zabbix Server before 1.6.8 allows remote attackers to execute arbitrary SQL commands via a crafted request, possibly related to the send_history_last_id function in zabbix_server/trapper/nodehistory.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/37740; http://www.securityfocus.com/archive/1/508436/30/60/threaded; http://www.vupen.com/english/advisories/2009/3514
CVE: CVE-2009-4500
Published: 2009-12-31
Description: The process_trap function in trapper/trapper.c in Zabbix Server before 1.6.6 allows remote attackers to cause a denial of service (crash) via a crafted request with data that lacks an expected : (colon) separator, which triggers a NULL pointer dereference.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://secunia.com/advisories/37740; http://www.securityfocus.com/archive/1/508436/30/60/threaded; http://www.vupen.com/english/advisories/2009/3514
CVE: CVE-2009-4501
Published: 2009-12-31
Description: The zbx_get_next_field function in libs/zbxcommon/str.c in Zabbix Server before 1.6.8 allows remote attackers to cause a denial of service (crash) via a request that lacks expected separators, which triggers a NULL pointer dereference, as demonstrated using the Command keyword.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://secunia.com/advisories/37740; http://www.securityfocus.com/archive/1/508436/30/60/threaded; http://www.vupen.com/english/advisories/2009/3514
CVE: CVE-2009-4502
Published: 2009-12-31
Description: The NET_TCP_LISTEN function in net.c in Zabbix Agent before 1.6.7, when running on FreeBSD or Solaris, allows remote attackers to bypass the EnableRemoteCommands setting and execute arbitrary commands via shell metacharacters in the argument to net.tcp.listen.  NOTE: this attack is limited to attacks from trusted IP addresses.
CVSS Score: 9.3 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/37740; http://www.securityfocus.com/archive/1/508439; http://www.vupen.com/english/advisories/2009/3514
CVE: CVE-2009-4512
Published: 2009-12-31
Description: Directory traversal vulnerability in index.php in Oscailt 3.3, when Use Friendly URL's is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the obj_id parameter.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.org/0910-exploits/oscailt33-lfi.txt; http://secunia.com/advisories/37180; http://securityreason.com/exploitalert/7422
CVE: CVE-2009-4513
Published: 2009-12-31
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Workflow module 5.x before 5.x-2.4 and 6.x before 6.x-1.2, a module for Drupal, allow remote authenticated users, with "administer workflow" privileges, to inject arbitrary web script or HTML via the name of a (1) workflow or (2) workflow state.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://drupal.org/node/612832; http://drupal.org/node/612834; http://drupal.org/node/617456
CVE: CVE-2009-4514
Published: 2009-12-31
Description: Cross-site scripting (XSS) vulnerability in the OpenSocial Shindig-Integrator module 5.x and 6.x before 6.x-2.1, a module for Drupal, allows remote authenticated users, with "create application" privileges, to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://drupal.org/node/615584; http://drupal.org/node/617422; http://secunia.com/advisories/37200
CVE: CVE-2009-4515
Published: 2009-12-31
Description: The Storm module 6.x before 6.x-1.25 for Drupal does not enforce privilege requirements for storminvoiceitem nodes, which allows remote attackers to read node titles via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://drupal.org/node/617480; http://drupal.org/node/617494; http://secunia.com/advisories/37202
CVE: CVE-2009-4516
Published: 2009-12-31
Description: Cross-site scripting (XSS) vulnerability in the FAQ Ask module 5.x and 6.x before 6.x-2.0, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/617444; http://secunia.com/advisories/37201; http://www.securityfocus.com/bid/36877
CVE: CVE-2009-4517
Published: 2009-12-31
Description: Cross-site request forgery (CSRF) vulnerability in the FAQ Ask module 5.x and 6.x before 6.x-2.0, a module for Drupal, allows remote attackers to hijack the authentication of arbitrary users for requests that access unpublished content.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://drupal.org/node/617444; http://secunia.com/advisories/37201; http://www.vupen.com/english/advisories/2009/3088
CVE: CVE-2009-4518
Published: 2009-12-31
Description: Cross-site scripting (XSS) vulnerability in the Insert Node module 5.x before 5.x-1.2 for Drupal allows remote attackers to inject arbitrary web script or HTML via an inserted node.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/616546; http://drupal.org/node/617400; http://secunia.com/advisories/37199
CVE: CVE-2009-4519
Published: 2009-12-31
Description: Multiple unspecified vulnerabilities in Ortro before 1.3.4 have unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://dev.ortro.net/news/show/8; http://www.ortro.net/; http://www.vupen.com/english/advisories/2009/3057
CVE: CVE-2009-4520
Published: 2009-12-31
Description: The CCK Comment Reference module 5.x before 5.x-1.2 and 6.x before 6.x-1.3, a module for Drupal, allows remote attackers to bypass intended access restrictions and read comments by using the autocomplete path.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://drupal.org/node/617380; http://secunia.com/advisories/37206; http://www.securityfocus.com/bid/36863
CVE: CVE-2009-4521
Published: 2009-12-31
Description: Cross-site scripting (XSS) vulnerability in birt-viewer/run in Eclipse Business Intelligence and Reporting Tools (BIRT) before 2.5.0, as used in KonaKart and other products, allows remote attackers to inject arbitrary web script or HTML via the __report parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://antisnatchor.com/2008/12/18/eclipse-birt-reflected-xss; http://secunia.com/advisories/37025; http://www.osvdb.org/58941
CVE: CVE-2009-4522
Published: 2009-12-31
Description: Cross-site scripting (XSS) vulnerability in search.5.html in BloofoxCMS 0.3.5 allows remote attackers to inject arbitrary web script or HTML via the search parameter to index.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/58948; http://packetstormsecurity.org/0910-exploits/bloofoxcms-xss.txt; http://secunia.com/advisories/37020
CVE: CVE-2009-4523
Published: 2009-12-31
Description: Cross-site scripting (XSS) vulnerability in index.php in Zainu 1.0 allows remote attackers to inject arbitrary web script or HTML via the searchSongKeyword parameter in a SearchSong action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/36798; http://www.packetstormsecurity.org/0910-exploits/zainu-xss.txt; http://www.securityfocus.com/bid/36701
CVE: CVE-2009-4524
Published: 2009-12-31
Description: Cross-site scripting (XSS) vulnerability in the RealName module 6.x-1.x before 6.x-1.3 for Drupal allows remote attackers to inject arbitrary web script or HTML via a realname (aka real name) element.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/604760; http://osvdb.org/58944; http://secunia.com/advisories/37058
CVE: CVE-2009-4525
Published: 2009-12-31
Description: Cross-site scripting (XSS) vulnerability in the Print (aka Printer, e-mail and PDF versions) module 5.x before 5.x-4.9 and 6.x before 6.x-1.9, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via crafted data in a list of links.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/604804; http://drupal.org/node/604806; http://drupal.org/node/604808
CVE: CVE-2009-4526
Published: 2009-12-31
Description: The Send by e-mail sub-module in the Print (aka Printer, e-mail and PDF versions) module 5.x before 5.x-4.9 and 6.x before 6.x-1.9, a module for Drupal, does not properly enforce privilege requirements, which allows remote attackers to read page titles by requesting a "Send to friend" form.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://drupal.org/node/604804; http://drupal.org/node/604806; http://drupal.org/node/604808
CVE: CVE-2009-4527
Published: 2009-12-31
Description: The Shibboleth authentication module 5.x before 5.x-3.4 and 6.x before 6.x-3.2, a module for Drupal, does not properly remove statically granted privileges after a logout or other session change, which allows physically proximate attackers to gain privileges by using an unattended web browser.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: http://drupal.org/node/604488; http://secunia.com/advisories/37057; http://www.securityfocus.com/bid/36684
CVE: CVE-2009-4528
Published: 2009-12-31
Description: The Organic Groups (OG) Vocabulary module 6.x before 6.x-1.0 for Drupal allows remote authenticated group members to bypass intended access restrictions, and create, modify, or read a vocabulary, via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://drupal.org/node/604354; http://drupal.org/node/604514; http://osvdb.org/58947
CVE: CVE-2009-4529
Published: 2009-12-31
Description: InterVations NaviCOPA Web Server 3.0.1.2 and earlier allows remote attackers to obtain the source code for a web page via a trailing encoded space character in a URI, as demonstrated by /index.html%20 and /index.php%20 URIs.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://freetexthost.com/n5l0h34pxc; http://osvdb.org/58949; http://pocoftheday.blogspot.com/2009/10/navicopa-web-server-3012-remote-source.html
CVE: CVE-2009-4530
Published: 2009-12-31
Description: Mongoose 2.8.0 and earlier allows remote attackers to obtain the source code for a web page by appending ::$DATA to the URI.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://packetstormsecurity.org/0910-exploits/mongoose-disclose.txt; http://secunia.com/advisories/36934; http://packetstormsecurity.org/0910-exploits/mongoose-disclose.txt
CVE: CVE-2009-4531
Published: 2009-12-31
Description: httpdx 1.4.4 and earlier allows remote attackers to obtain the source code for a web page by appending a . (dot) character to the URI.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://freetexthost.com/eiyfyt0km5; http://packetstormsecurity.org/0910-exploits/httpdx-disclose.txt; http://pocoftheday.blogspot.com/2009/10/httpdx-144-remote-arbitrary-source.html
CVE: CVE-2009-4532
Published: 2009-12-31
Description: Cross-site scripting (XSS) vulnerability in the Webform module 5.x before 5.x-2.8 and 6.x before 6.x-2.8, a module for Drupal, allows remote authenticated users, with webform creation privileges, to inject arbitrary web script or HTML via a field label.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://drupal.org/node/604942; http://osvdb.org/58945; http://secunia.com/advisories/37021
CVE: CVE-2009-4533
Published: 2009-12-31
Description: The Webform module 5.x before 5.x-2.8 and 6.x before 6.x-2.8, a module for Drupal, does not prevent caching of a page that contains token placeholders for a default value, which allows remote attackers to read session variables via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://drupal.org/node/604920; http://drupal.org/node/604922; http://drupal.org/node/604942
CVE: CVE-2009-4534
Published: 2009-12-31
Description: Open redirect vulnerability in the FAQ Ask module 5.x and 6.x before 6.x-2.0, a module for Drupal, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
References: http://drupal.org/node/617444; http://www.securityfocus.com/bid/36877; http://drupal.org/node/617444
CVE: CVE-2009-4535
Published: 2009-12-31
Description: Mongoose 2.8.0 and earlier allows remote attackers to obtain the source code for a web page by appending a / (slash) character to the URI.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://freetexthost.com/0lcsrgt3vw; http://pocoftheday.blogspot.com/2009/10/mongoose-web-server-v280-remote-source_22.html; http://secunia.com/advisories/36934
CVE: CVE-2009-4539
Published: 2010-01-04
Description: Cross-site scripting (XSS) vulnerability in main.php in SQLiteManager 1.2.0 allows remote attackers to inject arbitrary web script or HTML via the redirect parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/28642; http://www.securityfocus.com/archive/1/505636/100/0/threaded; http://www.securityfocus.com/bid/36002
CVE: CVE-2009-4540
Published: 2010-01-04
Description: SQL injection vulnerability in page.php in Mini CMS 1.0.1 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/9406; http://www.securityfocus.com/bid/36011; https://exchange.xforce.ibmcloud.com/vulnerabilities/52369
CVE: CVE-2009-4541
Published: 2010-01-04
Description: Multiple PHP remote file inclusion vulnerabilities in IsolSoft Support Center 2.5 allow remote attackers to execute arbitrary PHP code via a URL in the lang parameter to (1) newticket.php or (2) rempass.php, or a URL in the lang parameter in an adduser action to (3) index.php. NOTE: this can also be leveraged to include and execute arbitrary local files via .. (dot dot) sequences.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://osvdb.org/56869; http://osvdb.org/56870; http://osvdb.org/56871
CVE: CVE-2009-4542
Published: 2010-01-04
Description: Cross-site scripting (XSS) vulnerability in newticket.php in IsolSoft Support Center 2.5 allows remote attackers to inject arbitrary web script or HTML via the lang parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.exploit-db.com/exploits/9397; http://www.securityfocus.com/bid/35997; https://exchange.xforce.ibmcloud.com/vulnerabilities/52351
CVE: CVE-2009-4543
Published: 2010-01-04
Description: PHP remote file inclusion vulnerability in index.php in Cromosoft Technologies Facil Helpdesk 2.3 Lite allows remote attackers to execute arbitrary PHP code via a URL in the lng parameter.  NOTE: this can also be leveraged to include and execute arbitrary local files via .. (dot dot) sequences.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/36209; http://www.exploit-db.com/exploits/9396; https://exchange.xforce.ibmcloud.com/vulnerabilities/52362
CVE: CVE-2009-4544
Published: 2010-01-04
Description: Cross-site scripting (XSS) vulnerability in kbase/kbase.php in Cromosoft Technologies Facil Helpdesk 2.3 Lite allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/36209; http://www.exploit-db.com/exploits/9396; https://exchange.xforce.ibmcloud.com/vulnerabilities/52361