Vulnerabilities > Vwar > Virtual WAR > 1.0.6

DATE CVE VULNERABILITY TITLE RISK
2007-08-31 CVE-2007-4605 Code Injection vulnerability in Vwar Virtual WAR
PHP remote file inclusion vulnerability in convert/mvcw.php in Virtual War (VWar) 1.5.0 R15 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the vwar_root parameter, a different vector than CVE-2006-1503, CVE-2006-1636, and CVE-2006-1747.
network
low complexity
vwar CWE-94
7.5
2007-04-26 CVE-2007-2306 Cross-Site Scripting vulnerability in VWar
Multiple cross-site scripting (XSS) vulnerabilities in the Virtual War (VWar) 1.5.0 R15 and earlier module for PHP-Nuke, when register_globals is enabled, allow remote attackers to inject arbitrary web script or HTML via the (1) memberlist parameter to extra/login.php and the (2) title parameter to extra/today.php.
network
vwar
4.3
2006-08-18 CVE-2006-4224 Cross-Site Scripting vulnerability in Virtual War
Cross-site scripting (XSS) vulnerability in calendar.php in Virtual War (VWar) 1.5.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the year parameter.
network
vwar
4.3
2006-08-14 CVE-2006-4141 SQL-Injection vulnerability in Virtual War
SQL injection vulnerability in news.php in Virtual War (VWar) 1.5.0 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) sortby and (2) sortorder parameters.
network
low complexity
vwar
7.5
2006-06-22 CVE-2006-3139 SQL Injection vulnerability in Vwar Virtual WAR
Multiple SQL injection vulnerabilities in war.php in Virtual War (VWar) 1.5.0 R14 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) s, (2) showgame, (3) sortorder, and (4) sortby parameters.
network
low complexity
vwar CWE-89
7.5
2006-04-29 CVE-2006-2091 Information Disclosure vulnerability in Virtual War
admin.php in Virtual War (VWar) 1.5 and versions before 1.2 allows remote attackers to obtain sensitive information via an invalid vwar_root parameter, which reveals the path in an error message.
network
low complexity
vwar
5.0
2006-04-06 CVE-2006-1636 Code Injection vulnerability in Vwar Virtual WAR
PHP remote file inclusion vulnerability in get_header.php in VWar 1.5.0 R12 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the vwar_root parameter.
network
low complexity
vwar CWE-94
7.5
2006-03-30 CVE-2006-1503 Code Injection vulnerability in Vwar Virtual WAR
PHP remote file inclusion vulnerability in includes/functions_install.php in Virtual War (VWar) 1.5.0 R11 and earlier allows remote attackers to include and execute arbitrary PHP code via a URL in the vwar_root parameter.
network
high complexity
vwar CWE-94
5.1