rainbutterfly/cve_corpus huggingface dataset:
CVE-2008-6124 
SQL injection vulnerability in the hotpot_delete_selected_attempts function in report.php in the HotPot module in Moodle 1.6 before 1.6.7, 1.7 before 1.7.5, 1.8 before 1.8.6, and 1.9 before 1.9.2 allows remote attackers to execute arbitrary SQL commands via a crafted selected attempt.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-13T01:00:00.000Z
CVE-2008-6125 
Unspecified vulnerability in the user editing interface in Moodle 1.5.x, 1.6 before 1.6.6, and 1.7 before 1.7.3 allows remote authenticated users to gain privileges via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-13T01:00:00.000Z
CVE-2008-6126 
Multiple directory traversal vulnerabilities in moziloCMS 1.10.2 and earlier allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) file parameter to download.php and the (2) page parameter to index.php, a different vector than CVE-2008-3589.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-13T18:00:00.000Z
CVE-2008-6127 
Multiple cross-site scripting (XSS) vulnerabilities in moziloCMS 1.10.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) page and (2) query parameters to (a) index.php, (3) cat and (4) file parameters to (b) download.php, (5) gal parameter to gallery.php, and the (6) URL to admin/login.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-13T18:00:00.000Z
CVE-2008-6128 
Session fixation vulnerability in moziloCMS 1.10.2 and earlier allows remote attackers to hijack web sessions by setting the PHPSESSID parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-13T18:00:00.000Z
CVE-2008-6129 
Directory traversal vulnerability in print.php in moziloWiki 1.0.1 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the page parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-13T18:00:00.000Z
CVE-2008-6130 
Cross-site scripting (XSS) vulnerability in index.php in moziloWiki 1.0.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) action and (2) page parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-13T18:00:00.000Z
CVE-2008-6131 
Session fixation vulnerability in moziloWiki 1.0.1 and earlier allows remote attackers to hijack web sessions by setting the PHPSESSID parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-13T18:00:00.000Z
CVE-2008-6132 
Eval injection vulnerability in reserve.php in phpScheduleIt 1.2.10 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary PHP code via the start_date parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-13T18:00:00.000Z
CVE-2008-6133 
SQL injection vulnerability in arsaprint.php in Full PHP Emlak Script allows remote attackers to execute arbitrary SQL commands via the id parameter, a different vector than CVE-2008-3942.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-13T18:00:00.000Z
CVE-2008-6134 
SQL injection vulnerability in EveryBlog 5.x and 6.x, a module for Drupal, allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-14T02:00:00.000Z
CVE-2008-6135 
Cross-site scripting (XSS) vulnerability in EveryBlog 5.x and 6.x, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-14T02:00:00.000Z
CVE-2008-6136 
Unspecified vulnerability in EveryBlog 5.x and 6.x, a module for Drupal, allows remote attackers to gain privileges as another user or an administrator via unknown attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-14T02:00:00.000Z
CVE-2008-6137 
EveryBlog 5.x and 6.x, a module for Drupal, allows remote attackers to bypass access restrictions via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-14T02:00:00.000Z
CVE-2008-6138 
PHP remote file inclusion vulnerability in adminhead.php in WebBiscuits Modules Controller 1.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the path[docroot] parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-14T02:00:00.000Z
CVE-2008-6139 
Directory traversal vulnerability in faqsupport/wce.download.php in WebBiscuits Modules Controller 1.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the download parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-14T02:00:00.000Z
CVE-2008-6140 
Unspecified vulnerability in the Session Initiation Protocol (SIP) implementation in Avaya one-X Desktop Edition 2.1.0.78 allows remote attackers to cause a denial of service (crash) via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-14T02:00:00.000Z
CVE-2008-6141 
Unspecified vulnerability in Avaya IP Softphone 6.0 SP4 and 6.01.85 allows remote attackers to cause a denial of service (crash) via a large amount of H.323 data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-14T02:00:00.000Z
CVE-2008-6142 
Multiple SQL injection vulnerabilities in admin/usercheck.php in FlexPHPic 0.0.4 and FlexPHPic Pro 0.0.3, and other 0.0.x versions, allow remote attackers to execute arbitrary SQL commands via (1) the checkuser parameter (aka username field), or (2) the checkpass parameter (aka password field), to admin/index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-16T17:00:00.000Z
CVE-2008-6143 
OwenPoll 1.0 allows remote attackers to bypass authentication and obtain administrative access via a modified account name in the username cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-16T17:00:00.000Z
CVE-2008-6144 
Multiple cross-site scripting (XSS) vulnerabilities in the WEC Discussion Forum (wec_discussion) extension 1.7.0 and earlier for TYPO3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different issue than CVE-2008-3029.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-16T17:00:00.000Z
CVE-2008-6145 
Multiple SQL injection vulnerabilities in the WEC Discussion Forum (wec_discussion) extension 1.7.0 and earlier for TYPO3 allow remote attackers to execute arbitrary SQL commands via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-16T17:00:00.000Z
CVE-2008-6146 
SQL injection vulnerability in pm.php in DeluxeBB 1.2 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via a delete##### parameter in a Delete action, a different vector than CVE-2005-2989.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-16T17:00:00.000Z
CVE-2008-6147 
ForumApp 3.3 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for (1) data/8690.mdb or (2) data/8690BAK.mdb.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-16T17:00:00.000Z
CVE-2008-6148 
SQL injection vulnerability in the Live Ticker (com_liveticker) module 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the tid parameter in a viewticker action to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-16T17:00:00.000Z
CVE-2008-6149 
SQL injection vulnerability in the mDigg (com_mdigg) component 2.2.8 for Joomla! allows remote attackers to execute arbitrary SQL commands via the cagtegory parameter in a story_lists action to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-16T17:00:00.000Z
CVE-2008-6150 
SQL injection vulnerability in classdis.asp in SepCity Classified Ads allows remote attackers to execute arbitrary SQL commands via the ID parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-16T17:00:00.000Z
CVE-2008-6151 
SQL injection vulnerability in shpdetails.asp in SepCity Shopping Mall allows remote attackers to execute arbitrary SQL commands via the ID parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-16T17:00:00.000Z
CVE-2008-6152 
SQL injection vulnerability in deptdisplay.asp in SepCity Faculty Portal allows remote attackers to execute arbitrary SQL commands via the ID parameter.  NOTE: this was originally reported for Lawyer Portal, which does not have a deptdisplay.asp file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-16T17:00:00.000Z
CVE-2008-6153 
SQL injection vulnerability in Photo.asp in Jay Patel Pixel8 Web Photo Album 3.0 allows remote attackers to execute arbitrary SQL commands via the AlbumID parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-16T17:00:00.000Z
CVE-2008-6154 
SQL injection vulnerability in index.php in Hispah Text Links Ads 1.1 allows remote attackers to execute arbitrary SQL commands via the idcat parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-16T18:00:00.000Z
CVE-2008-6155 
SQL injection vulnerability in index.php in Hispah Text Links Ads 1.1 allows remote attackers to execute arbitrary SQL commands via the idtl parameter in a buy action.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-16T18:00:00.000Z
CVE-2008-6156 
SQL injection vulnerability in editCampaign.php in AdMan 1.1.20070907 allows remote authenticated users to execute arbitrary SQL commands via the campaignId parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-16T18:00:00.000Z
CVE-2008-6157 
SepCity Classified Ads stores the admin password in cleartext in data/classifieds.mdb, which allows context-dependent attackers to obtain sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-17T17:00:00.000Z
CVE-2008-6158 
Multiple unspecified vulnerabilities in the admin backend in w3b>cms (aka w3blabor CMS) before 3.2.0 have unknown impact and remote attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-17T17:00:00.000Z
CVE-2008-6159 
Content Management Made Easy (CMME) 1.19 allows remote attackers to obtain system information via a direct request to info.php, which invokes the phpinfo function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-18T16:00:00.000Z
CVE-2008-6160 
Semantically-Interconnected Online Communities (SIOC) 5.x before 5.x-1.2 and 6.x before 6.x-1.1, a module for Drupal, does not properly implement menu and database APIs, which allows remote attackers to obtain usernames and read hashed emails and comments via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-18T16:00:00.000Z
CVE-2008-6161 
Cross-site scripting (XSS) vulnerability in WOW Raid Manager (WRM) before 3.5.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-18T16:00:00.000Z
CVE-2008-6162 
Bux.to Clone script allows remote attackers to bypass authentication and gain administrative access by setting the loggedin cookie to 1 and the usNick cookie to admin.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-18T17:00:00.000Z
CVE-2008-6163 
SQL injection vulnerability in www/delivery/ac.php in OpenX 2.6.1 allows remote attackers to execute arbitrary SQL commands via the bannerid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-18T17:00:00.000Z
CVE-2008-6164 
Cross-site scripting (XSS) vulnerability in index.php in DreamCost HostAdmin 3.1.1 allows remote attackers to inject arbitrary web script or HTML via the page parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-18T17:00:00.000Z
CVE-2008-6165 
SQL injection vulnerability in gestion.php in CSPartner 0.1, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the (1) pseudo and (2) passe parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-19T00:00:00.000Z
CVE-2008-6166 
SQL injection vulnerability in the KBase (com_kbase) 1.2 component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in an article action to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-19T00:00:00.000Z
CVE-2008-6167 
Directory traversal vulnerability in search.php in miniPortail 2.2 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lng parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-19T15:02:00.000Z
CVE-2008-6168 
Cross-site scripting (XSS) vulnerability in search.php in miniPortail 2.2 and earlier allows remote attackers to inject arbitrary web script or HTML via an unspecified argument, probably the search string.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-19T15:02:00.000Z
CVE-2008-6169 
Cross-site request forgery (CSRF) vulnerability in the Localization client 5.x before 5.x-1.1 and 6.x before 6.x-1.6 and the Localization server 5.x before 5.x-1.0-alpha5 and 6.x before 6.x-alpha2, modules for Drupal, allows remote attackers to perform unauthorized actions as administrators via unspecified vectors related to the "local translation submission interface."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-19T15:02:00.000Z
CVE-2008-6170 
Cross-site scripting (XSS) vulnerability in Drupal 5.x before 5.12 and 6.x before 6.6 allows remote authenticated users with create book content or edit node book hierarchy permissions to inject arbitrary web script or HTML via the book page title.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-19T15:02:00.000Z
CVE-2008-6171 
includes/bootstrap.inc in Drupal 5.x before 5.12 and 6.x before 6.6, when the server is configured for "IP-based virtual hosts," allows remote attackers to include and execute arbitrary files via the HTTP Host header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-19T15:02:00.000Z
CVE-2008-6172 
Directory traversal vulnerability in captcha/captcha_image.php in the RWCards (com_rwcards) 3.0.11 component for Joomla!, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the img parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-19T16:00:00.000Z
CVE-2008-6173 
Cross-site scripting (XSS) vulnerability in fullscreen.php in ClipShare Pro 4.0 allows remote attackers to inject arbitrary web script or HTML via the title parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-19T16:00:00.000Z
CVE-2008-6174 
Cross-site scripting (XSS) vulnerability in admin/postlister/index.php in Jetbox CMS 2.1 allows remote attackers to inject arbitrary web script or HTML via the liste parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-19T16:00:00.000Z
CVE-2008-6175 
SilverSHielD 1.0.2.34 allows remote attackers to cause a denial of service (application crash) via a crafted argument to the opendir SFTP command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-19T16:00:00.000Z
CVE-2008-6177 
Multiple directory traversal vulnerabilities in LightBlog 9.8, when magic_quotes_gpc is disabled, allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the (1) username parameter to view_member.php, (2) username_post parameter to login.php, and the (3) Lightblog_username cookie parameter to check_user.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-19T16:00:00.000Z
CVE-2008-6178 
Unrestricted file upload vulnerability in editor/filemanager/browser/default/connectors/php/connector.php in FCKeditor 2.2, as used in Falt4 CMS, Nuke ET, and other products, allows remote attackers to execute arbitrary code by creating a file with PHP sequences preceded by a ZIP header, uploading this file via a FileUpload action with the application/zip content type, and then accessing this file via a direct request to the file in UserFiles/File/, probably a related issue to CVE-2005-4094.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-19T16:00:00.000Z
CVE-2008-6179 
SQL injection vulnerability in sug_cat.php in IndexScript 3.0 allows remote attackers to execute arbitrary SQL commands via the parent_id parameter, a different vector than CVE-2007-4069.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-19T18:00:00.000Z
CVE-2008-6180 
SQL injection vulnerability in system/nlb_user.class.php in NewLife Blogger 3.0 and earlier, and possibly 3.3.1, allows remote attackers to execute arbitrary SQL commands via the nlb3 cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-19T18:00:00.000Z
CVE-2008-6181 
SQL injection vulnerability in the Mad4Joomla Mailforms (com_mad4joomla) component before 1.1.8.2 for Joomla! allows remote attackers to execute arbitrary SQL commands via the jid parameter to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-19T18:00:00.000Z
CVE-2008-6182 
SQL injection vulnerability in the Ignite Gallery (com_ignitegallery) component 0.8.0 through 0.8.3 for Joomla! allows remote attackers to execute arbitrary SQL commands via the gallery parameter in a view action to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-19T18:00:00.000Z
CVE-2008-6183 
Multiple directory traversal vulnerabilities in index.php in My PHP Indexer 1.0 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) d and (2) f parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-19T18:00:00.000Z
CVE-2008-6184 
SQL injection vulnerability in the OwnBiblio (com_ownbiblio) component 1.5.3 for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter in a catalogue action to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-19T18:00:00.000Z
CVE-2008-6185 
NoticeWare Email Server NG 5.1.2.2 allows remote attackers to cause a denial of service (crash) via multiple POP3 requests with a long PASS command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-19T18:00:00.000Z
CVE-2008-6186 
Stack-based buffer overflow in RaidenFTPD 2.4 build 3620 allows remote authenticated users to cause a denial of service (crash) or execute arbitrary code via long (1) CWD and (2) MLST commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-19T18:00:00.000Z
CVE-2008-6187 
SQL injection vulnerability in frs/shownotes.php in Gforge 4.5.19 and earlier allows remote attackers to execute arbitrary SQL commands via the release_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-19T18:00:00.000Z
CVE-2008-6188 
SQL injection vulnerability in people/editprofile.php in Gforge 4.6 rc1 and earlier allows remote attackers to execute arbitrary SQL commands via the skill_edit[] parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-19T18:00:00.000Z
CVE-2008-6189 
SQL injection vulnerability in GForge 4.5.19 allows remote attackers to execute arbitrary SQL commands via the offset parameter to (1) new/index.php, (2) news/index.php, and (3) top/topusers.php, which is not properly handled in database-pgsql.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-19T18:00:00.000Z
CVE-2008-6190 
Cross-site scripting (XSS) vulnerability in index.php in EEBCMS 0.95 allows remote attackers to inject arbitrary web script or HTML via the content parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-19T18:00:00.000Z
CVE-2008-6191 
Conductor.exe in Intrinsic Swimage Encore before 5.0.1.21 contains a hardcoded password, which might allow local users to decrypt certain .bin files.  NOTE: it is not clear whether this issue crosses privilege boundaries.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-19T18:00:00.000Z
CVE-2008-6192 
Multiple cross-site scripting (XSS) vulnerabilities in unspecified Portlets in Sun Java System Portal Server 7.0 and 7.1 allow remote attackers to inject arbitrary web script or HTML via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-19T18:00:00.000Z
CVE-2008-6193 
Sam Crew MyBlog stores passwords in cleartext in a MySQL database, which allows context-dependent attackers to obtain sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-19T18:00:00.000Z
CVE-2008-6194 
Memory leak in the DNS server in Microsoft Windows allows remote attackers to cause a denial of service (memory consumption) via DNS packets.  NOTE: this issue reportedly exists because of an incorrect fix for CVE-2007-3898.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-19T18:00:00.000Z
CVE-2008-6195 
Directory traversal vulnerability in the PXE TFTP Service (PXEMTFTP.exe) in LANDesk Management Suite (LDMS) 8.80.1.1 and earlier allows remote attackers to read arbitrary files via a subdirectory name followed by ".." sequences, a different vulnerability than CVE-2008-1643.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-20T00:00:00.000Z
CVE-2008-6196 
Multiple PHP remote file inclusion vulnerabilities in Philippe CROCHAT EasySite 2.0 allow remote attackers to execute arbitrary PHP code via a URL in the EASYSITE_BASE parameter to (1) browser.php, (2) image_editor.php and (3) skin_chooser.php in configuration/.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-20T00:00:00.000Z