Stphp

Records3All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high1CVSS 7.0–8.9

Exploited now

Stphp records in CISA KEV

No Stphp vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Easynews 3 records MEDIUM

Records

3 records in Easynews · all components

TI-2006-06609 CVE-2006-6866 · GHSA-78c8-qm22-rp9r

STphp EasyNews PRO 4.0 stores sensitive information under the web root with insufficient…

MEDIUM 40

STphp EasyNews PRO 4.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain usernames, email addresses, and password hashes via a direct request for da…

CVSS 2.0HIGH 7.8 Network No auth Interaction — EPSS 0.03132 Published 2007-01-04 No fix listed

TI-2007-03226 CVE-2007-3331 · GHSA-fpm8-7326-6p2g

Cross-site request forgery (CSRF) vulnerability in STphp EasyNews PRO 4.0 allows remote…

LOW 25

Cross-site request forgery (CSRF) vulnerability in STphp EasyNews PRO 4.0 allows remote attackers to change the admin password via (1) a certain HTML form that is posted automatically by JavaScript or (2) a news post.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.0118 Published 2007-06-21 No fix listed

TI-2007-03225 CVE-2007-3330 · GHSA-4hf8-w7gm-6656

Cross-site scripting (XSS) vulnerability in STphp EasyNews PRO 4.0 allows remote…

LOW 22

Cross-site scripting (XSS) vulnerability in STphp EasyNews PRO 4.0 allows remote attackers to inject arbitrary web script or HTML via a news post, which is stored in news/ without sanitization.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.0106 Published 2007-06-21 No fix listed

Open these records in search →

Critical	0
High	1
Medium	2
Low	0
No CVSS	0