Vulnerabilities

TI-2009-01165 CVE-2009-1230 · GHSA-jjp4-5j58-3cr7

Static code injection vulnerability in index.php in Podcast Generator 1.1 and earlier…

LOW 32

Static code injection vulnerability in index.php in Podcast Generator 1.1 and earlier allows remote authenticated administrators to inject arbitrary PHP code into config.php via the recent parameter in a config change ac…

CVSS 2.0MEDIUM 6.5 Network Low privileges Interaction — EPSS 0.0179 Published 2009-04-02 No fix listed CWE-94

TI-2009-01161 CVE-2009-1226 · GHSA-frhv-7qjc-6v9c

core/admin/delete.php in Podcast Generator 1.1 and earlier does not properly restrict…

LOW 37

core/admin/delete.php in Podcast Generator 1.1 and earlier does not properly restrict access to administrative functions, which allows remote attackers to delete arbitrary files via the file parameter.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.02349 Published 2009-04-02 No fix listed CWE-264

TI-2008-01164 CVE-2008-1212 · GHSA-r8hv-wgxj-5j8f

Cross-site scripting (XSS) vulnerability in set_permissions.php in Podcast Generator…

LOW 22

Cross-site scripting (XSS) vulnerability in set_permissions.php in Podcast Generator 0.96.2 allows remote attackers to inject arbitrary web script or HTML via the scriptlang parameter.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.00845 Published 2008-03-08 No fix listed CWE-79

TI-2008-01078 CVE-2008-1125 · GHSA-98vw-8qqv-933g

Multiple directory traversal vulnerabilities in Podcast Generator 1.0 BETA 2 and earlier…

LOW 28

Multiple directory traversal vulnerabilities in Podcast Generator 1.0 BETA 2 and earlier allow remote attackers to read arbitrary files via a ..

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.03084 Published 2008-03-03 No fix listed CWE-22

TI-2008-01077 CVE-2008-1124 · GHSA-wrq6-29gg-753f

Multiple PHP remote file inclusion vulnerabilities in Podcast Generator 1.0 BETA 2 and…

MEDIUM 49

Multiple PHP remote file inclusion vulnerabilities in Podcast Generator 1.0 BETA 2 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the absoluteurl parameter to (1) components/xmlparser/loadp…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.21529 Published 2008-03-03 No fix listed CWE-94