Most severe vulnerabilities for "webspell webspell" 4.01.02

Where

AND

Sort:

webSPELL WebspellPath Traversal

Risk 52

Severity

7.5

Path Traversal

AV:N/AC:L/Au:N/C:P/I:P/A:P

Absolute path traversal vulnerability in index.php in Webspell 4.01.02 allows remote attackers to include and execute arbitrary local files via a full pathname in the site parameter. NOTE: some of these details are obtained from third party information.

First published (updated )

CVE-2007-4028

webSPELL WebspellSQL Injection

Risk 52

Severity

7.5

SQL Injection

AV:N/AC:L/Au:N/C:P/I:P/A:P

SQL injection vulnerability in printview.php in webSPELL 4.01.02 and earlier allows remote attackers to execute arbitrary SQL commands via the topic parameter, a different vector than CVE-2007-1019, CVE-2006-5388, and CVE-2006-4783.

First published (updated )

CVE-2007-1163

webSPELL WebspellSQL Injection

Risk 52

Severity

7.5

SQL Injection

AV:N/AC:L/Au:N/C:P/I:P/A:P

SQL injection vulnerability in gallery.php in webSPELL 4.01.02 allows remote attackers to execute arbitrary SQL commands via the picID parameter, a different vector than CVE-2007-0492.

First published (updated )

CVE-2007-0502

webSPELL WebspellSQL Injection

Risk 52

Severity

7.5

SQL Injection

AV:N/AC:L/Au:N/C:P/I:P/A:P

Multiple SQL injection vulnerabilities in gallery.php in webSPELL 4.01.02 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id or (2) galleryID parameter. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.

First published (updated )

CVE-2007-0492

webSPELL WebspellSQL Injection

Risk 47

Severity

6.8

SQL Injection

AV:N/AC:M/Au:N/C:P/I:P/A:P

SQL injection vulnerability in news.php in webSPELL 4.01.02, when registerglobals is enabled, allows remote attackers to execute arbitrary SQL commands via the showonly parameter to index.php, a different vector than CVE-2006-5388.

First published (updated )

CVE-2007-1019

webSPELL WebspellPath Traversal, SQL Injection

Risk 47

Severity

6.8

Path Traversal, SQL Injection

AV:N/AC:M/Au:N/C:P/I:P/A:P

Directory traversal vulnerability in src/func/language.php in webSPELL 4.2.0e and earlier allows remote attackers to include and execute arbitrary local .php files via a .. (dot dot) in a language cookie. NOTE: this can be leveraged for SQL injection by including awards.php.

First published (updated )

CVE-2009-1912

PHP PHPDirectory traversal vulnerability in picture.php in WebSPELL 4.01.02 and earlier, when PHP before 4.…

Risk 26

Severity

AV:N/AC:L/Au:N/C:P/I:N/A:N

Directory traversal vulnerability in picture.php in WebSPELL 4.01.02 and earlier, when PHP before 4.3.0 is used, allows remote attackers to read arbitrary files via a .. (dot dot) in the id parameter.

First published (updated )

CVE-2007-2369

webSPELL Webspellpicture.php in WebSPELL 4.01.02 and earlier allows remote attackers to read arbitrary files via the …

Risk 26

Severity

AV:N/AC:L/Au:N/C:P/I:N/A:N

picture.php in WebSPELL 4.01.02 and earlier allows remote attackers to read arbitrary files via the file parameter.

First published (updated )

CVE-2007-2368

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.

Trending

Company

Resources

Contact