Vulnerabilities

TI-2007-04225 CVE-2007-4365 · GHSA-8j2f-wxx3-3hpg

Cross-site scripting (XSS) vulnerability in eXV2 CMS 2.0.5 and earlier allows remote…

LOW 22

Cross-site scripting (XSS) vulnerability in eXV2 CMS 2.0.5 and earlier allows remote attackers to inject arbitrary web script or HTML via a set_lang cookie to an unspecified component.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01065 Published 2007-08-15 No fix listed

TI-2007-01888 CVE-2007-1966 · GHSA-pwvm-4x89-4v8h

Session fixation vulnerability in eXV2 CMS 2.0.4.3 and earlier allows remote attackers to…

MEDIUM 50

Session fixation vulnerability in eXV2 CMS 2.0.4.3 and earlier allows remote attackers to hijack web sessions by setting the PHPSESSID cookie.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.01275 Published 2007-04-11 No fix listed CWE-287

TI-2007-01887 CVE-2007-1965 · GHSA-4ffq-cv3j-qm3q

Multiple cross-site scripting (XSS) vulnerabilities in eXV2 CMS 2.0.4.3 and earlier allow…

LOW 22

Multiple cross-site scripting (XSS) vulnerabilities in eXV2 CMS 2.0.4.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the set_lang parameter to (1) archive.php, (2) article.php, (3) index.…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01074 Published 2007-04-11 No fix listed

TI-2006-06822 CVE-2006-7080 · GHSA-rppq-v6fg-6j6j

Directory traversal vulnerability in the avatar upload feature in exV2 2.0.4.3 and…

LOW 28

Directory traversal vulnerability in the avatar upload feature in exV2 2.0.4.3 and earlier allows remote attackers to delete arbitrary files via ".." sequences in the old_avatar parameter.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.04717 Published 2007-02-27 No fix listed

TI-2006-06821 CVE-2006-7079 · GHSA-p97q-m42v-rwxw

Variable extraction vulnerability in include/common.php in exV2 2.0.4.3 and earlier…

MEDIUM 56

Variable extraction vulnerability in include/common.php in exV2 2.0.4.3 and earlier allows remote attackers to overwrite arbitrary program variables and conduct directory traversal attacks to execute arbitrary code by mo…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.12939 Published 2007-02-27 No fix listed CWE-22

TI-2006-04846 CVE-2006-5030 · GHSA-f5g8-2xm5-mx52

SQL injection vulnerability in modules/messages/index.php in exV2 2.0.4.3 and earlier…

LOW 35

SQL injection vulnerability in modules/messages/index.php in exV2 2.0.4.3 and earlier allows remote authenticated users to execute arbitrary SQL commands via the sort parameter.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.01129 Published 2006-09-27 No fix listed