Vulnerabilities

TI-2008-05772 CVE-2008-6078 · GHSA-cxrq-gpp6-27jx

SQL injection vulnerability in open.php in the Private Messaging (com_privmsg) component…

LOW 35

SQL injection vulnerability in open.php in the Private Messaging (com_privmsg) component for Limbo CMS allows remote attackers to execute arbitrary SQL commands via the id parameter in a pms action to index.php.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.00967 Published 2009-02-06 No fix listed CWE-89

TI-2008-00700 CVE-2008-0734 · GHSA-m89j-25jw-r9vq

SQL injection vulnerability in class_auth.php in Limbo CMS 1.0.4.2, and possibly earlier…

LOW 35

SQL injection vulnerability in class_auth.php in Limbo CMS 1.0.4.2, and possibly earlier versions, allows remote attackers to execute arbitrary SQL commands via the cuid cookie parameter to admin.php.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.01045 Published 2008-02-13 No fix listed CWE-89

TI-2007-06261 CVE-2007-6564 · GHSA-pq23-cf85-q872

Cross-site scripting (XSS) vulnerability in admin.php in Limbo CMS 1.0.4.2 allows remote…

LOW 23

Cross-site scripting (XSS) vulnerability in admin.php in Limbo CMS 1.0.4.2 allows remote attackers to inject arbitrary web script or HTML via the com_option parameter.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01718 Published 2007-12-28 No fix listed CWE-79

TI-2006-06543 CVE-2006-6800 · GHSA-37h4-j973-qf8x

PHP remote file inclusion in eventcal/mod_eventcal.php in the event module 1.0 for Limbo…

LOW 36

PHP remote file inclusion in eventcal/mod_eventcal.php in the event module 1.0 for Limbo CMS allows remote attackers to execute arbitrary PHP code via a URL in the lm_absolute_path parameter.

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.0347 Published 2006-12-28 No fix listed

TI-2006-04687 CVE-2006-4860 · GHSA-h93h-m869-3gwc

Multiple unspecified vulnerabilities in (1) index.php, (2) minixml.inc.php, (3)…

MEDIUM 49

Multiple unspecified vulnerabilities in (1) index.php, (2) minixml.inc.php, (3) doc.inc.php, (4) element.inc.php, (5) node.inc.php, (6) treecomp.inc.php, (7) forum.html.php, (8) forum.php, (9) antihack.php, (10) content.…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.03157 Published 2006-09-19 No fix listed

TI-2006-04686 CVE-2006-4859 · GHSA-crg7-c4x5-jq8x

Unrestricted file upload vulnerability in contact.html.php in the Contact (com_contact)…

MEDIUM 43

Unrestricted file upload vulnerability in contact.html.php in the Contact (com_contact) component in Limbo (aka Lite Mambo) CMS 1.0.4.2L and earlier allows remote attackers to upload PHP code to the images/contact folder…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.07522 Published 2006-09-19 No fix listed

TI-2006-02302 CVE-2006-2363 · GHSA-9863-hfhh-89pm

SQL injection vulnerability in the weblinks option (weblinks.html.php) in Limbo CMS…

LOW 28

SQL injection vulnerability in the weblinks option (weblinks.html.php) in Limbo CMS allows remote attackers to execute arbitrary SQL commands via the catid parameter.

CVSS 2.0MEDIUM 5.1 Network No auth Interaction — EPSS 0.02326 Published 2006-05-15 No fix listed CWE-16

TI-2006-02086 CVE-2006-2142 · GHSA-x8pm-wcv3-frg2

PHP remote file inclusion vulnerability in classes/adodbt/sql.php in Limbo CMS 1.04 and…

LOW 39

PHP remote file inclusion vulnerability in classes/adodbt/sql.php in Limbo CMS 1.04 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the classes_dir parameter.

CVSS 2.0MEDIUM 6.4 Network No auth Interaction — EPSS 0.08105 Published 2006-05-02 No fix listed

TI-2006-01609 CVE-2006-1662 · GHSA-rxh3-xv5g-963f

The frontpage option in Limbo CMS 1.0.4.2 and 1.0.4.1 allows remote attackers to execute…

LOW 39

The frontpage option in Limbo CMS 1.0.4.2 and 1.0.4.1 allows remote attackers to execute arbitrary PHP commands via the Itemid parameter in index.php.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.03358 Published 2006-04-07 No fix listed

TI-2006-00909 CVE-2006-0934 · GHSA-xxwx-xvv4-fvjw

Cross-site scripting (XSS) vulnerability in webinsta Limbo 1.0.4.2 allows remote…

LOW 23

Cross-site scripting (XSS) vulnerability in webinsta Limbo 1.0.4.2 allows remote attackers to inject arbitrary web script or HTML via the message field in the Contact Form.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01296 Published 2006-02-28 No fix listed

TI-2005-04064 CVE-2005-4320 · GHSA-h222-ch2w-vqfv

Limbo CMS 1.0.4.2 and earlier allows remote attackers to obtain the installation path of…

LOW 26

Limbo CMS 1.0.4.2 and earlier allows remote attackers to obtain the installation path of the application via a direct request to (1) doc.inc.php, (2) element.inc.php, and (3) node.inc.php, which leaks the path in an erro…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.01821 Published 2005-12-17 No fix listed CWE-200

TI-2005-04063 CVE-2005-4319 · GHSA-9jxx-wv7p-h3g3

Directory traversal vulnerability in index2.php in Limbo CMS 1.0.4.2 and earlier allows…

LOW 29

Directory traversal vulnerability in index2.php in Limbo CMS 1.0.4.2 and earlier allows remote attackers to include arbitrary PHP files via ".." sequences in the option parameter.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.03236 Published 2005-12-17 No fix listed

TI-2005-04061 CVE-2005-4317 · GHSA-9xx5-rr5h-pjg2

Limbo CMS 1.0.4.2 and earlier, with register_globals off, does not protect the $_SERVER…

LOW 38

Limbo CMS 1.0.4.2 and earlier, with register_globals off, does not protect the $_SERVER variable from external modification, which allows remote attackers to use the _SERVER[REMOTE_ADDR] parameter to (1) conduct cross-si…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.05245 Published 2005-12-17 No fix listed

Vulnerabilities

Filters