Vulnerabilities

TI-2007-00514 CVE-2007-0527 · GHSA-x2mr-2crh-pjv2

SQL injection vulnerability in the is_remembered function in class.login.php in Website…

LOW 33

SQL injection vulnerability in the is_remembered function in class.login.php in Website Baker 2.6.5 and earlier allows remote attackers to execute arbitrary SQL commands via the REMEMBER_KEY cookie parameter.

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.01389 Published 2007-01-26 No fix listed CWE-89

TI-2006-02247 CVE-2006-2307 · GHSA-7wfj-vxqm-p4gp

Cross-site scripting (XSS) vulnerability in Website Baker CMS before 2.6.4 allows remote…

LOW 23

Cross-site scripting (XSS) vulnerability in Website Baker CMS before 2.6.4 allows remote attackers to inject arbitrary web script or HTML via a user display name.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01338 Published 2006-05-11 No fix listed

TI-2005-03895 CVE-2005-4140 · GHSA-q5fc-7mw8-7mpw

SQL injection vulnerability in admin/login/index.php in Website Baker 2.6.0 allows remote…

LOW 37

SQL injection vulnerability in admin/login/index.php in Website Baker 2.6.0 allows remote attackers to execute arbitrary SQL commands via the username parameter, as used by the user field.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.02163 Published 2005-12-09 No fix listed

TI-2005-02307 CVE-2005-2437 · GHSA-rm2j-9pmq-6jj4

Website Baker Project does not properly verify the file extensions of uploaded files…

LOW 26

Website Baker Project does not properly verify the file extensions of uploaded files, which allows remote attackers to upload and execute arbitrary PHP code.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.01351 Published 2005-08-03 No fix listed

TI-2005-02306 CVE-2005-2436 · GHSA-x72g-gxxm-h944

browse.php in Website Baker Project allows remote attackers to obtain sensitive data via…

LOW 26

browse.php in Website Baker Project allows remote attackers to obtain sensitive data via (1) a directory that does not exist in the dir parameter or (2) a direct request to certain php files, which reveal the path in an…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.01388 Published 2005-08-03 No fix listed

TI-2005-02305 CVE-2005-2435 · GHSA-xp7h-368q-wc44

Cross-site scripting (XSS) vulnerability in browse.php in Website Baker Project allows…

LOW 22

Cross-site scripting (XSS) vulnerability in browse.php in Website Baker Project allows remote attackers to inject arbitrary web script or HTML via the dir parameter.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01177 Published 2005-08-03 No fix listed