Vulnerabilities > Vwar > Virtual WAR > 1.5.0
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2011-09-24 | CVE-2011-3813 | Information Exposure vulnerability in Vwar Virtual WAR 1.5.0 Virtual War (aka VWar) 1.5.0r15 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by includes/language/dutch.inc.php and certain other files. | 5.0 |
| 2007-08-31 | CVE-2007-4605 | Code Injection vulnerability in Vwar Virtual WAR PHP remote file inclusion vulnerability in convert/mvcw.php in Virtual War (VWar) 1.5.0 R15 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the vwar_root parameter, a different vector than CVE-2006-1503, CVE-2006-1636, and CVE-2006-1747. | 7.5 |
| 2007-04-26 | CVE-2007-2306 | Cross-Site Scripting vulnerability in VWar Multiple cross-site scripting (XSS) vulnerabilities in the Virtual War (VWar) 1.5.0 R15 and earlier module for PHP-Nuke, when register_globals is enabled, allow remote attackers to inject arbitrary web script or HTML via the (1) memberlist parameter to extra/login.php and the (2) title parameter to extra/today.php. network vwar | 4.3 |
| 2006-08-18 | CVE-2006-4224 | Cross-Site Scripting vulnerability in Virtual War Cross-site scripting (XSS) vulnerability in calendar.php in Virtual War (VWar) 1.5.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the year parameter. network vwar | 4.3 |
| 2006-08-14 | CVE-2006-4142 | SQL Injection vulnerability in VWar Virtual WAR SQL injection vulnerability in extra/online.php in Virtual War (VWar) 1.5.0 R14 and earlier allows remote attackers to execute arbitrary SQL commands via the n parameter. | 7.5 |
| 2006-08-14 | CVE-2006-4141 | SQL-Injection vulnerability in Virtual War SQL injection vulnerability in news.php in Virtual War (VWar) 1.5.0 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) sortby and (2) sortorder parameters. | 7.5 |
| 2006-08-07 | CVE-2006-4010 | SQL Injection vulnerability in Vwar Virtual WAR 1.5.0 SQL injection vulnerability in war.php in Virtual War (Vwar) 1.5.0 and earlier allows remote attackers to execute arbitrary SQL commands via the page parameter. | 7.5 |
| 2006-08-07 | CVE-2006-4009 | Input Validation vulnerability in Vwar Virtual WAR 1.5.0 Cross-site scripting (XSS) vulnerability in war.php in Virtual War (Vwar) 1.5.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the page parameter. network vwar | 4.3 |
| 2006-06-22 | CVE-2006-3139 | SQL Injection vulnerability in Vwar Virtual WAR Multiple SQL injection vulnerabilities in war.php in Virtual War (VWar) 1.5.0 R14 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) s, (2) showgame, (3) sortorder, and (4) sortby parameters. | 7.5 |