Vulnerabilities > Geeklog > Geeklog > 1.3.11
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2012-09-09 | CVE-2011-5159 | Cross-Site Scripting vulnerability in Geeklog Cross-site scripting (XSS) vulnerability in admin/configuration.php in Geeklog before 1.7.1sr1 allows remote attackers to inject arbitrary web script or HTML via the sub_group parameter, a different vulnerability than CVE-2011-4942. | 4.3 |
| 2012-09-09 | CVE-2011-4942 | Cross-Site Scripting vulnerability in Geeklog Multiple cross-site scripting (XSS) vulnerabilities in admin/configuration.php in Geeklog before 1.7.1sr1 allow remote attackers to inject arbitrary web script or HTML via the (1) subgroup or (2) conf_group parameters. | 4.3 |
| 2006-07-21 | CVE-2006-3756 | Cross-Site Scripting vulnerability in Geeklog 1.3.11/1.4.0 Cross-site scripting (XSS) vulnerability in Geeklog 1.4.0sr4 and earlier, and 1.3.11sr6 and earlier, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors when validating comments in (1) lib-comment.php (1.4.0sr4) or (2) comment.php (0.3.11sr6). | 4.3 |
| 2006-05-31 | CVE-2006-2701 | SQL-Injection vulnerability in Geeklog (Extended Japanese Package) SQL injection vulnerability in Geeklog 1.4.0sr2 and earlier allows remote attackers to execute arbitrary SQL commands via unknown vectors related to story submission. | 7.5 |
| 2006-05-31 | CVE-2006-2700 | Input Validation vulnerability in Geeklog SQL injection vulnerability in admin/auth.inc.php in Geeklog 1.4.0sr2 and earlier allows remote attackers to execute arbitrary SQL commands and bypass authentication via the loginname parameter. | 5.1 |
| 2006-05-31 | CVE-2006-2699 | Input Validation vulnerability in Geeklog Cross-site scripting (XSS) vulnerability in getimage.php in Geeklog 1.4.0sr2 and earlier allows remote attackers to inject arbitrary HTML or web script via the image argument in a show action. network geeklog | 6.8 |
| 2006-05-31 | CVE-2006-2698 | Input Validation vulnerability in Geeklog Geeklog 1.4.0sr2 and earlier allows remote attackers to obtain the full installation path via a direct request and possibly invalid arguments to (1) layout/professional/functions.php or (2) getimage.php. | 7.8 |
| 2006-03-07 | CVE-2006-1069 | Unspecified vulnerability in Geeklog Unspecified vulnerability in the session handling for Geeklog 1.4.x before 1.4.0sr2, 1.3.11 before 1.3.11sr5, 1.3.9 before 1.3.9sr5, and possibly earlier versions allows attackers to gain privileges as arbitrary users via unknown vectors. | 10.0 |
| 2006-02-21 | CVE-2006-0824 | Input Validation vulnerability in Geeklog Multiple unspecified vulnerabilities in lib-common.php in Geeklog 1.4.0 before 1.4.0sr1 and 1.3.11 before 1.3.11sr4 allow remote attackers to include arbitrary local files and execute arbitrary code via (1) absolute paths in unspecified parameters and (2) the language cookie, as demonstrated for code execution using error.log. | 7.5 |
| 2006-02-21 | CVE-2006-0823 | Input Validation vulnerability in Geeklog Multiple SQL injection vulnerabilities in Geeklog 1.4.0 before 1.4.0sr1 and 1.3.11 before 1.3.11sr4 allow remote attackers to inject arbitrary SQL commands via the (1) userid variable to users.php or (2) sessid variable to lib-sessions.php. | 7.5 |