VYPR
← XOOPS

Vendor CVEs

XOOPS

All CVEs

107 total · sorted by risk
  • CVE-2017-11174CriJul 12, 2017
    XOOPS
    Xoops
    risk 0.64cvss 9.8epss 0.01

    In install/page_dbsettings.php in the Core distribution of XOOPS 2.5.8.1, unfiltered data passed to CREATE and ALTER SQL queries caused SQL Injection in the database settings page, related to use of GBK in CHARACTER SET and COLLATE clauses.

  • CVE-2017-7290HigMar 30, 2017
    XOOPS
    Xoops
    risk 0.47cvss 7.2epss 0.02

    SQL injection vulnerability in XOOPS 2.5.7.2 and other versions before 2.5.8.1 allows remote authenticated administrators to execute arbitrary SQL commands via the url parameter to findusers.php. An example attack uses "into outfile" to create a backdoor program.

  • CVE-2017-12139MedAug 2, 2017
    XOOPS
    Xoops
    risk 0.40cvss 6.1epss 0.01

    XOOPS Core 2.5.8 has stored XSS in imagemanager.php because of missing MIME type validation in htdocs/class/uploader.php.

  • CVE-2017-12138MedAug 2, 2017
    XOOPS
    Xoops
    risk 0.40cvss 6.1epss 0.03

    XOOPS Core 2.5.8 has a stored URL redirect bypass vulnerability in /modules/profile/index.php because of the URL filter.

  • CVE-2017-7944MedApr 24, 2017
    XOOPS
    Xoops
    risk 0.40cvss 6.1epss 0.01

    XOOPS Core 2.5.8.1 has XSS due to unescaped HTML output of an Install DB failure error message in page_dbsettings.php.

  • CVE-2007-3236Jun 15, 2007
    XOOPS
    Horoscope Module
    risk 0.09cvss —epss 0.77

    PHP remote file inclusion vulnerability in footer.php in the Horoscope 1.0 module for XOOPS allows remote attackers to execute arbitrary PHP code via a URL in the xoopsConfig[root_path] parameter.

  • CVE-2007-3237Jun 15, 2007
    XOOPS
    Tinycontent Module
    risk 0.08cvss —epss 0.68

    PHP remote file inclusion vulnerability in admin/spaw/spaw_control.class.php in the TinyContent 1.5 module for XOOPS allows remote attackers to execute arbitrary PHP code via a URL in the spaw_root parameter. NOTE: this issue is probably a duplicate of CVE-2006-4656.

  • CVE-2007-3220Jun 14, 2007
    XOOPS
    Cjay Content Module
    risk 0.08cvss —epss 0.63

    PHP remote file inclusion vulnerability in admin/editor2/spaw_control.class.php in the Cjay Content 3 module for XOOPS allows remote attackers to execute arbitrary PHP code via a URL in the spaw_root parameter. NOTE: this may be a duplicate of CVE-2006-4656.

  • CVE-2007-3221Jun 14, 2007
    XOOPS
    Xt Conteudo Module
    risk 0.08cvss —epss 0.68

    PHP remote file inclusion vulnerability in admin/spaw/spaw_control.class.php in the XT-Conteudo module for XOOPS allows remote attackers to execute arbitrary PHP code via a URL in the spaw_root parameter. NOTE: this issue is probably a duplicate of CVE-2006-4656.

  • CVE-2007-3057Jun 6, 2007
    XOOPS
    Icontent Module
    risk 0.08cvss —epss 0.69

    PHP remote file inclusion vulnerability in include/wysiwyg/spaw_control.class.php in the icontent 4.5 module for XOOPS allows remote attackers to execute arbitrary PHP code via a URL in the spaw_root parameter. NOTE: this issue is probably a duplicate of CVE-2006-4656.

  • CVE-2007-3289Jun 20, 2007
    XOOPS
    Wiwimod Module
    risk 0.04cvss —epss 0.12

    PHP remote file inclusion vulnerability in spaw/spaw_control.class.php in the WiwiMod 0.4 module for XOOPS allows remote attackers to execute arbitrary PHP code via a URL in the spaw_root parameter. NOTE: this issue is probably a duplicate of CVE-2006-4656.

  • CVE-2007-3222Jun 14, 2007
    XOOPS
    Xfsection Module
    risk 0.04cvss —epss 0.07

    PHP remote file inclusion vulnerability in modify.php in the XFsection 1.07 module for XOOPS allows remote attackers to execute arbitrary PHP code via a URL in the dir_module parameter.

  • CVE-2006-2516May 22, 2006
    XOOPS
    Xoops
    risk 0.04cvss —epss 0.06

    mainfile.php in XOOPS 2.0.13.2 and earlier, when register_globals is enabled, allows remote attackers to overwrite variables such as $xoopsOption['nocommon'] and conduct directory traversal attacks or include PHP files via (1) xoopsConfig[language] to misc.php or (2)…

  • CVE-2012-0984Sep 11, 2014
    XOOPS
    Xoops
    risk 0.03cvss —epss 0.04

    Multiple cross-site scripting (XSS) vulnerabilities in XOOPS before 2.5.5 allow remote attackers to inject arbitrary web script or HTML via the (1) to_userid parameter to modules/pm/pmlite.php or the (2) current_file, (3) imgcat_id, or (4) target parameter to…

  • CVE-2014-3935Jun 2, 2014
    XOOPS
    Glossaire Module
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in glossaire-aff.php in the Glossaire module 1.0 for XOOPS allows remote attackers to execute arbitrary SQL commands via the lettre parameter.

  • CVE-2009-4714Mar 15, 2010
    Alexandre Amaral
    Xoops Celepar
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the quiz module for XOOPS Celepar allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to cadastro_usuario.php.

  • CVE-2009-4713Mar 15, 2010
    XOOPS
    Qas
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in the Qas (aka Quas) module for XOOPS Celepar allow remote attackers to inject arbitrary web script or HTML via (1) the cod_categoria parameter to categoria.php, (2) the opcao parameter to index.php, and the PATH_INFO to (3)…

  • CVE-2009-4698Mar 15, 2010
    XOOPS
    Qas
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in the Qas (aka Quas) module for XOOPS Celepar allow remote attackers to execute arbitrary SQL commands via the codigo parameter to (1) aviso.php and (2) imprimir.php, and the (3) cod_categoria parameter to categoria.php.

  • CVE-2009-4582Jan 6, 2010
    XOOPS
    Dictionary module
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in detail.php in the Dictionary module for XOOPS 2.0.18 allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2009-4360Dec 20, 2009
    Handcoders
    Content Module
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in modules/content/index.php in the Content module 0.5 for XOOPS allows remote attackers to inject arbitrary web script or HTML via the id parameter.

  • CVE-2008-7178Sep 8, 2009
    XOOPS
    Uploader
    risk 0.03cvss —epss 0.02

    Directory traversal vulnerability in Uploader module 1.1 for XOOPS allows remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter in a downloadfile action to index.php.

  • CVE-2009-2783Aug 17, 2009
    XOOPS
    Xoops
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in XOOPS 2.3.3 allow remote attackers to inject arbitrary web script or HTML via the (1) op parameter to modules/pm/viewpmsg.php and (2) query string to modules/profile/user.php.

  • CVE-2008-6884Jul 31, 2009
    XOOPS
    Xoops
    risk 0.03cvss —epss 0.06

    Multiple directory traversal vulnerabilities in XOOPS 2.3.1, when register_globals is enabled, allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the xoopsConfig[language] parameter to (1) blocks.php and (2) main.php in…

  • CVE-2008-5768Dec 30, 2008
    XOOPS
    AM Events
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in print.php in the AM Events (aka Amevents) module 0.22 for XOOPS allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2008-5665Dec 19, 2008
    XOOPS
    Xoops
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in the xhresim module in XOOPS allows remote attackers to execute arbitrary SQL commands via the no parameter.

  • CVE-2008-5321Dec 3, 2008
    XOOPS
    GesGaleri
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in GesGaleri, a module for XOOPS, allows remote attackers to execute arbitrary SQL commands via the no parameter.

  • CVE-2008-4653Oct 22, 2008
    XOOPS
    Makale
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in makale.php in Makale 0.26 and possibly other versions, a module for XOOPS, allows remote attackers to execute arbitrary SQL commands via the id parameter. NOTE: some of these details are obtained from third party information.

  • CVE-2008-3668Aug 13, 2008
    XOOPS
    Yogurt Social Network module
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in the Yogurt Social Network module 3.2 rc1 for XOOPS allow remote attackers to inject arbitrary web script or HTML via the uid parameter to (1) friends.php, (2) seutubo.php, (3) album.php, (4) scrapbook.php, (5) index.php, or…

  • CVE-2008-3560Aug 8, 2008
    XOOPS
    Kshop Module
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in kshop_search.php in the Kshop module 2.22 for Xoops allows remote attackers to inject arbitrary web script or HTML via the search parameter.

  • CVE-2008-3296Jul 25, 2008
    XOOPS
    Xoops
    risk 0.03cvss —epss 0.06

    Directory traversal vulnerability in modules/system/admin.php in XOOPS 2.0.18 1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the fct parameter. NOTE: the provenance of this information is unknown; the details are obtained solely…

  • CVE-2008-3295Jul 25, 2008
    XOOPS
    Xoops
    risk 0.03cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in modules/system/admin.php in XOOPS 2.0.18.1 allows remote attackers to inject arbitrary web script or HTML via the fct parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party…

  • CVE-2008-2094May 6, 2008
    XOOPS
    Article Module
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in article.php in the Article module for XOOPS allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2008-1351Mar 17, 2008
    XOOPS
    Tutoriais Module
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the Tutorials 2.1b module for XOOPS allows remote attackers to execute arbitrary SQL commands via the tid parameter to printpage.php, which is accessible directly or through a printpage action to index.php.

  • CVE-2008-0937Feb 25, 2008
    Tinyevent
    Tinyevent
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in the Tiny Event (tinyevent) 1.01 module for XOOPS allows remote attackers to execute arbitrary SQL commands via the id parameter in a print action, a different vector than CVE-2007-1811.

  • CVE-2008-0936Feb 25, 2008
    XOOPS
    Prayer List Module
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in the Prayer List (prayerlist) 1.04 module for XOOPS allows remote attackers to execute arbitrary SQL commands via the cid parameter in a view action.

  • CVE-2008-0873Feb 21, 2008
    Jlmzone
    Classifieds
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in the jlmZone Classifieds module for XOOPS allows remote attackers to execute arbitrary SQL commands via the cid parameter in an Adsview action.

  • CVE-2008-0874Feb 21, 2008
    XOOPS
    Eempregos Module
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in the eEmpregos module for XOOPS allows remote attackers to execute arbitrary SQL commands via the cid parameter in a view action.

  • CVE-2008-0847Feb 21, 2008
    XOOPS
    Mytopics
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in print.php in the myTopics module for XOOPS allows remote attackers to execute arbitrary SQL commands via the articleid parameter.

  • CVE-2008-0613Feb 6, 2008
    XOOPS
    Xoops
    risk 0.03cvss —epss 0.02

    Open redirect vulnerability in htdocs/user.php in XOOPS 2.0.18 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the xoops_redirect parameter.

  • CVE-2008-0612Feb 6, 2008
    XOOPS
    Xoops
    risk 0.03cvss —epss 0.03

    Directory traversal vulnerability in htdocs/install/index.php in XOOPS 2.0.18 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lang parameter.

  • CVE-2008-0611Feb 6, 2008
    XOOPS
    Xoops
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in rmgs/images.php in the RMSOFT Gallery System 2.0 module for XOOPS allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2008-0138Jan 8, 2008
    XOOPS
    mod_gallery
    risk 0.03cvss —epss 0.05

    PHP remote file inclusion vulnerability in xoopsgallery/init_basic.php in the mod_gallery module for XOOPS, when register_globals is disabled, allows remote attackers to execute arbitrary PHP code via a URL in the GALLERY_BASEDIR parameter.

  • CVE-2007-5978Nov 15, 2007
    XOOPS
    Mylinks Module
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in brokenlink.php in the mylinks module for XOOPS allows remote attackers to execute arbitrary SQL commands via the lid parameter.

  • CVE-2007-3311Jun 21, 2007
    XOOPS
    Articles Module
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in print.php in the Articles 1.02 and earlier module for Xoops allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2007-2738May 17, 2007
    XOOPS
    Glossaire Module
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in glossaire-p-f.php in the Glossaire 1.7 and earlier module for Xoops allows remote attackers to execute arbitrary SQL commands via the sid parameter in an ImprDef action.

  • CVE-2007-2737May 17, 2007
    XOOPS
    Myconference Module
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in the MyConference 1.0 module for Xoops allows remote attackers to execute arbitrary SQL commands via the cid parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

  • CVE-2007-2735May 17, 2007
    XOOPS
    ResManager
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in edit_day.php in the ResManager 1.2.1 and earlier module for Xoops allows remote attackers to execute arbitrary SQL commands via the id_reserv parameter.

  • CVE-2007-2571May 9, 2007
    XOOPS
    Wfquotes Module
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in index.php in the wfquotes 1.0 0 module for XOOPS allows remote attackers to execute arbitrary SQL commands via the c parameter in a cat action.

  • CVE-2007-2543May 9, 2007
    XOOPS
    Flashgames Module
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in game.php in the Flashgames 1.0.1 module for XOOPS allows remote attackers to execute arbitrary SQL commands via the lid parameter.

  • CVE-2007-2370Apr 30, 2007
    XOOPS
    John Mordo Jobs Module
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in index.php in the John Mordo Jobs 2.4 and earlier module for XOOPS allows remote attackers to execute arbitrary SQL commands via the cid parameter in a jobsview action. NOTE: the module name was originally reported as Job Listings.

Page 1 of 3