Vulnerabilities

TI-2008-06671 CVE-2008-6983 · GHSA-7c33-67p8-93vq

modules/tool/hitcounter.php in devalcms 1.4a allows remote attackers to execute arbitrary…

MEDIUM 42

modules/tool/hitcounter.php in devalcms 1.4a allows remote attackers to execute arbitrary PHP code via the HTTP Referer header with a target file specified in the gv_folder_data parameter, as demonstrated by modifying mo…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.05786 Published 2009-08-18 No fix listed CWE-94

TI-2008-06670 CVE-2008-6982 · GHSA-fv67-22pq-cq7h

Cross-site scripting (XSS) vulnerability in index.php in devalcms 1.4a allows remote…

LOW 29

Cross-site scripting (XSS) vulnerability in index.php in devalcms 1.4a allows remote attackers to inject arbitrary web script or HTML via the currentpath parameter.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.05782 Published 2009-08-18 No fix listed CWE-79

TI-2008-02787 CVE-2008-2913 · GHSA-77c9-x7gr-m8x8

Directory traversal vulnerability in func.php in Devalcms 1.4a, when magic_quotes_gpc is…

LOW 34

Directory traversal vulnerability in func.php in Devalcms 1.4a, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a ..

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.01857 Published 2008-06-30 No fix listed CWE-22

Vulnerabilities

Filters

modules/tool/hitcounter.php in devalcms 1.4a allows remote attackers to execute arbitrary…

Cross-site scripting (XSS) vulnerability in index.php in devalcms 1.4a allows remote…

Directory traversal vulnerability in func.php in Devalcms 1.4a, when magic_quotes_gpc is…