Show filters
4 Total Results
Displaying 1-4 of 4
Sort by:
Attacker Value
Unknown

CVE-2011-4565

Disclosure Date: November 28, 2011 (last updated October 04, 2023)
Multiple cross-site scripting (XSS) vulnerabilities in XOOPS 2.5.1.a, and possibly earlier versions, allow remote attackers to inject arbitrary web script or HTML via the (1) text parameter to include/formdhtmltextarea_preview.php or (2) img BBCODE tag within the message parameter to pmlite.php (aka Private Message). NOTE: some of these details are obtained from third party information.
0
0
Attacker Value
Unknown

CVE-2009-4851

Disclosure Date: May 07, 2010 (last updated October 04, 2023)
The activation resend function in the Profiles module in XOOPS before 2.4.1 sends activation codes in response to arbitrary activation requests, which allows remote attackers to bypass administrative approval via a request involving activate.php.
0
0
Attacker Value
Unknown

CVE-2009-3963

Disclosure Date: November 17, 2009 (last updated October 04, 2023)
Multiple unspecified vulnerabilities in XOOPS before 2.4.0 Final have unknown impact and attack vectors.
0
0
Attacker Value
Unknown

CVE-2007-0377

Disclosure Date: January 19, 2007 (last updated October 04, 2023)
Multiple SQL injection vulnerabilities in Xoops 2.0.16 allow remote attackers to execute arbitrary SQL commands via (1) the id parameter in kernel/group.php in core, (2) the lid parameter in class/table_broken.php in the Weblinks module, and other unspecified vectors.
0
0