Vulnerabilities

TI-2007-02070 CVE-2007-2149 · GHSA-w2cx-3pp9-7qw4

Stephen Craton (aka WiredPHP) Chatness 2.5.3 and earlier stores usernames and unencrypted…

MEDIUM 48

Stephen Craton (aka WiredPHP) Chatness 2.5.3 and earlier stores usernames and unencrypted passwords in (1) classes/vars.php and (2) classes/varstuff.php, and recommends 0666 or 0777 permissions for these files, which all…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.03088 Published 2007-04-19 No fix listed

TI-2007-02069 CVE-2007-2148 · GHSA-r8q7-f3rm-89r8

Direct static code injection vulnerability in admin/save.php in Stephen Craton (aka…

LOW 33

Direct static code injection vulnerability in admin/save.php in Stephen Craton (aka WiredPHP) Chatness 2.5.3 and earlier allows remote authenticated administrators to inject PHP code into .html files via the html paramet…

CVSS 2.0MEDIUM 6.5 Network Low privileges Interaction — EPSS 0.01991 Published 2007-04-19 No fix listed

TI-2007-02068 CVE-2007-2147 · GHSA-5w58-cwpp-6wrj

admin/options.php in Stephen Craton (aka WiredPHP) Chatness 2.5.3 and earlier does not…

MEDIUM 49

admin/options.php in Stephen Craton (aka WiredPHP) Chatness 2.5.3 and earlier does not check for administrative credentials, which allows remote attackers to read and modify the classes/vars.php and classes/varstuff.php…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.03416 Published 2007-04-19 No fix listed

Vulnerabilities

Filters

Stephen Craton (aka WiredPHP) Chatness 2.5.3 and earlier stores usernames and unencrypted…

Direct static code injection vulnerability in admin/save.php in Stephen Craton (aka…

admin/options.php in Stephen Craton (aka WiredPHP) Chatness 2.5.3 and earlier does not…