Vulnerabilities

TI-2008-06727 CVE-2008-7039 · GHSA-f6j8-hr9j-495h

Cross-site scripting (XSS) vulnerability in admin/comments.php in Gelato CMS 0.95 allows…

LOW 22

Cross-site scripting (XSS) vulnerability in admin/comments.php in Gelato CMS 0.95 allows remote attackers to inject arbitrary web script or HTML via the content parameter in a comment.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01033 Published 2009-08-24 No fix listed CWE-79

TI-2008-03519 CVE-2008-3675 · GHSA-28jm-hff2-853w

Directory traversal vulnerability in classes/imgsize.php in Gelato 0.95 allows remote…

LOW 28

Directory traversal vulnerability in classes/imgsize.php in Gelato 0.95 allows remote attackers to read arbitrary files via (1) a ..

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.0292 Published 2008-08-14 No fix listed CWE-22

TI-2007-04740 CVE-2007-4918 · GHSA-4phw-xx96-wm6w

SQL injection vulnerability in classes/gelato.class.php in Gelato allows remote attackers…

LOW 36

SQL injection vulnerability in classes/gelato.class.php in Gelato allows remote attackers to execute arbitrary SQL commands via the post parameter to index.php.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.01622 Published 2007-09-17 No fix listed CWE-89

Vulnerabilities

Filters

Cross-site scripting (XSS) vulnerability in admin/comments.php in Gelato CMS 0.95 allows…

Directory traversal vulnerability in classes/imgsize.php in Gelato 0.95 allows remote…

SQL injection vulnerability in classes/gelato.class.php in Gelato allows remote attackers…