Vulnerabilities > Etomite

DATE CVE VULNERABILITY TITLE RISK
2011-12-08 CVE-2011-4264 Cross-Site Scripting vulnerability in Etomite
Cross-site scripting (XSS) vulnerability in Etomite before 1.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
network
etomite CWE-79
4.3
2008-02-19 CVE-2008-0820 Cross-Site Scripting vulnerability in Etomite 0.6.1.4
** DISPUTED ** Cross-site scripting (XSS) vulnerability in index.php in Etomite 0.6.1.4 Final allows remote attackers to inject arbitrary web script or HTML via $_SERVER['PHP_INFO'].
network
etomite CWE-79
4.3
2007-03-02 CVE-2006-7070 Improper Input Validation vulnerability in Etomite 0.6
Unrestricted file upload vulnerability in manager/media/ibrowser/scripts/rfiles.php in Etomite CMS 0.6.1 and earlier allows remote attackers to upload and execute arbitrary files via an nfile[] parameter with a filename that contains a .php extension followed by a valid image extension such as .gif or .jpg, then calling the rename function.
network
low complexity
etomite CWE-20
7.5
2006-11-22 CVE-2006-6048 SQL Injection vulnerability in Etomite 0.6.1.2
SQL injection vulnerability in index.php in Etomite CMS 0.6.1.2, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the id parameter.
network
etomite CWE-89
6.8
2006-11-22 CVE-2006-6047 Path Traversal vulnerability in Etomite 0.6.1.2
Directory traversal vulnerability in manager/index.php in Etomite 0.6.1.2 allows remote authenticated administrators to include and execute arbitrary local files via a ..
network
low complexity
etomite CWE-22
5.8
2006-10-12 CVE-2006-5242 SQL Injection vulnerability in Etomite 0.6
SQL injection vulnerability in Etomite Content Management System (CMS) before 0.6.1.1 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
network
low complexity
etomite CWE-89
7.5
2006-07-27 CVE-2006-3904 SQL Injection vulnerability in Etomite 0.6
SQL injection vulnerability in manager/index.php in Etomite CMS 0.6.1 and earlier, with magic_quotes_gpc disabled, allows remote attackers to execute arbitrary SQL commands via the username parameter.
network
etomite CWE-89
6.8
2006-01-20 CVE-2006-0325 OS Command Injection vulnerability in Etomite
Etomite Content Management System 0.6, and possibly earlier versions, when downloaded from the web site in January 2006 after January 10, contains a back door in manager/includes/todo.inc.php, which allows remote attackers to execute arbitrary commands via the "cij" parameter.
network
low complexity
etomite CWE-78
7.5