Vulnerabilities

TI-2009-04683 CVE-2009-4927 · GHSA-hg58-7mh7-hwcq

WB News 2.1.2 allows remote attackers to bypass authentication and gain administrative…

LOW 38

WB News 2.1.2 allows remote attackers to bypass authentication and gain administrative access via a modified WBNEWS cookie, as demonstrated by setting this cookie to 1.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.02475 Published 2010-07-09 No fix listed CWE-287

TI-2010-01641 CVE-2010-1712 · GHSA-w28m-9f8c-36p9

Multiple cross-site scripting (XSS) vulnerabilities in base/Comments.php in Webmobo WB…

LOW 24

Multiple cross-site scripting (XSS) vulnerabilities in base/Comments.php in Webmobo WB News 2.3.3 allow remote attackers to inject arbitrary web script or HTML via the (1) name and possibly (2) message parameters.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01908 Published 2010-05-04 No fix listed CWE-79

TI-2009-00277 CVE-2009-0294 · GHSA-5gc8-v95q-vq8h

Multiple PHP remote file inclusion vulnerabilities in WB News 2.0.1, when…

LOW 34

Multiple PHP remote file inclusion vulnerabilities in WB News 2.0.1, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the config[installdir] parameter to (1) search.php,…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.01818 Published 2009-01-27 No fix listed CWE-94

TI-2007-01246 CVE-2007-1288 · GHSA-hj5x-24qh-4fx8

Multiple PHP remote file inclusion vulnerabilities in Webmobo WB News 1.4.1 and earlier…

MEDIUM 48

Multiple PHP remote file inclusion vulnerabilities in Webmobo WB News 1.4.1 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the config[installdir] parameter to (1) comment.php, (2) themes.ph…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.02939 Published 2007-03-07 No fix listed

TI-2006-00232 CVE-2006-0241 · GHSA-5pj6-vvhj-wxww

Cross-site scripting vulnerability in WBNews 1.1.0 and earlier allows remote attackers to…

LOW 26

Cross-site scripting vulnerability in WBNews 1.1.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the Name field.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.01351 Published 2006-01-18 No fix listed