Show filters
58 Total Results
Displaying 31-40 of 58
Sort by:
Attacker Value
Unknown
CVE-2009-3815
Disclosure Date: October 27, 2009 (last updated October 04, 2023)
RunCMS 2M1, when running with certain error_reporting levels, allows remote attackers to obtain sensitive information via (1) the op[] parameter to modules/contact/index.php or (2) uid[] parameter to userinfo.php, which leaks the installation path in an error message when these parameters are used in a call to the preg_match function.
0
Attacker Value
Unknown
CVE-2008-7222
Disclosure Date: September 14, 2009 (last updated October 04, 2023)
Cross-site scripting (XSS) vulnerability in system/admin.php in RunCMS 1.6.1 allows remote attackers to inject arbitrary web script or HTML via the rank_title parameter in a RankForumAdd action.
0
Attacker Value
Unknown
CVE-2008-7221
Disclosure Date: September 14, 2009 (last updated October 04, 2023)
Cross-site request forgery (CSRF) vulnerability in RunCMS 1.6.1 allows remote attackers to hijack the authentication of administrators for requests that (1) add new administrators or (2) modify user profiles via a crafted request to system/admin.php.
0
Attacker Value
Unknown
CVE-2008-3354
Disclosure Date: July 28, 2008 (last updated October 04, 2023)
Multiple PHP remote file inclusion vulnerabilities in the Newbb Plus (newbb_plus) module 0.93 in RunCMS 1.6.1 allow remote attackers to execute arbitrary PHP code via a URL in the (1) bbPath[path] parameter to votepolls.php and the (2) bbPath[root_theme] parameter to config.php, different vectors than CVE-2006-0659. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
0
Attacker Value
Unknown
CVE-2008-1551
Disclosure Date: March 31, 2008 (last updated October 04, 2023)
SQL injection vulnerability in viewcat.php in the Photo 3.02 module for RunCMS allows remote attackers to execute arbitrary SQL commands via the cid parameter.
0
Attacker Value
Unknown
CVE-2008-1462
Disclosure Date: March 24, 2008 (last updated October 04, 2023)
SQL injection vulnerability in the sections (Section) module in RunCMS allows remote attackers to execute arbitrary SQL commands via the artid parameter in a viewarticle action.
0
Attacker Value
Unknown
CVE-2008-0224
Disclosure Date: January 10, 2008 (last updated October 04, 2023)
SQL injection vulnerability in index.php in the Newbb_plus 0.92 and earlier module in RunCMS 1.6.1 allows remote attackers to execute arbitrary SQL commands via the Client-Ip parameter.
0
Attacker Value
Unknown
CVE-2007-6549
Disclosure Date: December 28, 2007 (last updated October 04, 2023)
Unspecified vulnerability in RunCMS before 1.6.1 has unknown impact and attack vectors, related to "pagetype using."
0
Attacker Value
Unknown
CVE-2007-6544
Disclosure Date: December 28, 2007 (last updated October 04, 2023)
Multiple SQL injection vulnerabilities in RunCMS before 1.6.1 allow remote attackers to execute arbitrary SQL commands via the lid parameter to (1) brokenfile.php, (2) visit.php, or (3) ratefile.php in modules/mydownloads/; or (4) ratelink.php, (5) modlink.php, or (6) brokenlink.php in modules/mylinks/.
0
Attacker Value
Unknown
CVE-2007-6546
Disclosure Date: December 28, 2007 (last updated October 04, 2023)
RunCMS before 1.6.1 uses a predictable session id, which makes it easier for remote attackers to hijack sessions via a modified id.
0
