Mambo
CVEs (46)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2005-2002 | 0.03 | — | 0.01 | Jun 15, 2005 | SQL injection vulnerability in content.php in Mambo 4.5.2.2 and earlier allows remote attackers to execute arbitrary SQL commands via the user_rating parameter. | |||
| CVE-2004-1692 | 0.03 | — | 0.02 | Sep 18, 2004 | Cross-site scripting (XSS) vulnerability in index.php in Mambo 4.5 (1.0.9) allows remote attackers to inject arbitrary web script or HTML via the (1) Itemid, (2) mosmsg, or (3) limit parameters. | |||
| CVE-2004-1693 | 0.03 | — | 0.03 | Sep 18, 2004 | PHP remote file inclusion vulnerability in Function.php in Mambo 4.5 (1.0.9) allows remote attackers to execute arbitrary PHP code by modifying the mosConfig_absolute_path parameter to reference a URL on a remote web server that contains the code. | |||
| CVE-2003-1245 | 0.03 | — | 0.04 | Dec 31, 2003 | index2.php in Mambo 4.0.12 allows remote attackers to gain administrator access via a URL request where session_id is set to the MD5 hash of a session cookie. | |||
| CVE-2011-2499 | 0.00 | — | 0.01 | Feb 12, 2020 | Mambo CMS through 4.6.5 has multiple XSS. | |||
| CVE-2013-2565 | 0.00 | — | 0.02 | Feb 15, 2019 | A vulnerability in Mambo CMS v4.6.5 where the scripts thumbs.php, editorFrame.php, editor.php, images.php, manager.php discloses the root path of the webserver. | |||
| CVE-2011-3754 | 0.00 | — | 0.01 | Sep 23, 2011 | Mambo 4.6.5 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by includes/sef.php and certain other files. | |||
| CVE-2008-7215 | 0.00 | — | 0.02 | Sep 11, 2009 | The Image Manager in MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allows remote attackers to rename arbitrary files and cause a denial of service via modified file[NewFile][name], file[NewFile][tmp_name], and file[NewFile][size] parameters in a FileUpload command,… | |||
| CVE-2008-7214 | 0.00 | — | 0.01 | Sep 11, 2009 | Cross-site request forgery (CSRF) vulnerability in administrator/index2.php in MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allows remote attackers to hijack the authentication of administrators for requests that add new administrator accounts via the save task in a… | |||
| CVE-2008-7212 | 0.00 | — | 0.02 | Sep 11, 2009 | MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allows remote attackers to obtain sensitive information via certain requests to mambots/editors/mostlyce/jscripts/tiny_mce/filemanager/connectors/php/connector.php, which reveals the installation path in an error message. | |||
| CVE-2008-2497 | 0.00 | — | 0.01 | May 28, 2008 | CRLF injection vulnerability in Mambo before 4.6.4 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors. | |||
| CVE-2008-2498 | 0.00 | — | 0.01 | May 28, 2008 | Multiple SQL injection vulnerabilities in index.php in Mambo before 4.6.4, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) articleid and (2) mcname parameters. NOTE: some of these details are obtained from third party… | |||
| CVE-2008-0261 | 0.00 | — | 0.01 | Jan 15, 2008 | Unspecified vulnerability in the search component and module in Mambo 4.5.x and 4.6.x allows remote attackers to cause a denial of service (query flood) via unspecified vectors. | |||
| CVE-2007-2557 | 0.00 | — | 0.01 | May 9, 2007 | MOStlyDB Admin in Mambo 4.6.1 does not properly check privileges, which allows remote authenticated administrators to have an unknown impact via unspecified vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party… | |||
| CVE-2006-7202 | 0.00 | — | 0.01 | May 9, 2007 | The dofreePDF function in includes/pdf.php in Mambo 4.6.1 does not properly check access rights for database content, which allows remote attackers to read certain content via unspecified vectors. | |||
| CVE-2006-7149 | 0.00 | — | 0.01 | Mar 7, 2007 | Multiple cross-site scripting (XSS) vulnerabilities in Mambo 4.6.x allow remote attackers to inject arbitrary web script or HTML via (1) the query string to (a) index.php, which reflects the string in an error message from mod_login.php; and the (2) mcname parameter to (b)… | |||
| CVE-2006-7150 | 0.00 | — | 0.01 | Mar 7, 2007 | Multiple SQL injection vulnerabilities in Mambo 4.6.x allow remote attackers to execute arbitrary SQL commands via the mcname parameter to (1) moscomment.php and (2) com_comment.php. | |||
| CVE-2007-0789 | 0.00 | — | 0.01 | Feb 6, 2007 | SQL injection vulnerability in Mambo before 4.5.5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors in cancel edit functions, possibly related to the id parameter. | |||
| CVE-2007-0374 | 0.00 | — | 0.01 | Jan 19, 2007 | SQL injection vulnerability in (1) Joomla! 1.0.11 and 1.5 Beta, and (2) Mambo 4.6.1, allows remote attackers to execute arbitrary SQL commands via the id parameter when cancelling content editing. | |||
| CVE-2006-4286 | 0.00 | — | 0.01 | Aug 22, 2006 | PHP remote file inclusion vulnerability in contentpublisher.php in the contentpublisher component (com_contentpublisher) for Mambo allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter. NOTE: this issue has been disputed by… |
- CVE-2005-2002Jun 15, 2005risk 0.03cvss —epss 0.01
SQL injection vulnerability in content.php in Mambo 4.5.2.2 and earlier allows remote attackers to execute arbitrary SQL commands via the user_rating parameter.
- CVE-2004-1692Sep 18, 2004risk 0.03cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in index.php in Mambo 4.5 (1.0.9) allows remote attackers to inject arbitrary web script or HTML via the (1) Itemid, (2) mosmsg, or (3) limit parameters.
- CVE-2004-1693Sep 18, 2004risk 0.03cvss —epss 0.03
PHP remote file inclusion vulnerability in Function.php in Mambo 4.5 (1.0.9) allows remote attackers to execute arbitrary PHP code by modifying the mosConfig_absolute_path parameter to reference a URL on a remote web server that contains the code.
- CVE-2003-1245Dec 31, 2003risk 0.03cvss —epss 0.04
index2.php in Mambo 4.0.12 allows remote attackers to gain administrator access via a URL request where session_id is set to the MD5 hash of a session cookie.
- CVE-2011-2499Feb 12, 2020risk 0.00cvss —epss 0.01
Mambo CMS through 4.6.5 has multiple XSS.
- CVE-2013-2565Feb 15, 2019risk 0.00cvss —epss 0.02
A vulnerability in Mambo CMS v4.6.5 where the scripts thumbs.php, editorFrame.php, editor.php, images.php, manager.php discloses the root path of the webserver.
- CVE-2011-3754Sep 23, 2011risk 0.00cvss —epss 0.01
Mambo 4.6.5 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by includes/sef.php and certain other files.
- CVE-2008-7215Sep 11, 2009risk 0.00cvss —epss 0.02
The Image Manager in MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allows remote attackers to rename arbitrary files and cause a denial of service via modified file[NewFile][name], file[NewFile][tmp_name], and file[NewFile][size] parameters in a FileUpload command,…
- CVE-2008-7214Sep 11, 2009risk 0.00cvss —epss 0.01
Cross-site request forgery (CSRF) vulnerability in administrator/index2.php in MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allows remote attackers to hijack the authentication of administrators for requests that add new administrator accounts via the save task in a…
- CVE-2008-7212Sep 11, 2009risk 0.00cvss —epss 0.02
MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allows remote attackers to obtain sensitive information via certain requests to mambots/editors/mostlyce/jscripts/tiny_mce/filemanager/connectors/php/connector.php, which reveals the installation path in an error message.
- CVE-2008-2497May 28, 2008risk 0.00cvss —epss 0.01
CRLF injection vulnerability in Mambo before 4.6.4 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.
- CVE-2008-2498May 28, 2008risk 0.00cvss —epss 0.01
Multiple SQL injection vulnerabilities in index.php in Mambo before 4.6.4, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) articleid and (2) mcname parameters. NOTE: some of these details are obtained from third party…
- CVE-2008-0261Jan 15, 2008risk 0.00cvss —epss 0.01
Unspecified vulnerability in the search component and module in Mambo 4.5.x and 4.6.x allows remote attackers to cause a denial of service (query flood) via unspecified vectors.
- CVE-2007-2557May 9, 2007risk 0.00cvss —epss 0.01
MOStlyDB Admin in Mambo 4.6.1 does not properly check privileges, which allows remote authenticated administrators to have an unknown impact via unspecified vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party…
- CVE-2006-7202May 9, 2007risk 0.00cvss —epss 0.01
The dofreePDF function in includes/pdf.php in Mambo 4.6.1 does not properly check access rights for database content, which allows remote attackers to read certain content via unspecified vectors.
- CVE-2006-7149Mar 7, 2007risk 0.00cvss —epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in Mambo 4.6.x allow remote attackers to inject arbitrary web script or HTML via (1) the query string to (a) index.php, which reflects the string in an error message from mod_login.php; and the (2) mcname parameter to (b)…
- CVE-2006-7150Mar 7, 2007risk 0.00cvss —epss 0.01
Multiple SQL injection vulnerabilities in Mambo 4.6.x allow remote attackers to execute arbitrary SQL commands via the mcname parameter to (1) moscomment.php and (2) com_comment.php.
- CVE-2007-0789Feb 6, 2007risk 0.00cvss —epss 0.01
SQL injection vulnerability in Mambo before 4.5.5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors in cancel edit functions, possibly related to the id parameter.
- CVE-2007-0374Jan 19, 2007risk 0.00cvss —epss 0.01
SQL injection vulnerability in (1) Joomla! 1.0.11 and 1.5 Beta, and (2) Mambo 4.6.1, allows remote attackers to execute arbitrary SQL commands via the id parameter when cancelling content editing.
- CVE-2006-4286Aug 22, 2006risk 0.00cvss —epss 0.01
PHP remote file inclusion vulnerability in contentpublisher.php in the contentpublisher component (com_contentpublisher) for Mambo allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter. NOTE: this issue has been disputed by…
Page 2 of 3