Flatnuke

Flatnuke

21 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
4.3

CVE-2007-5109

  • EPSS 0.18%
  • Veröffentlicht 26.09.2007 23:17:00
  • Zuletzt bearbeitet 09.04.2025 00:30:58

Cross-site request forgery (CSRF) vulnerability in index.php in FlatNuke 2.6, and possibly 3, allows remote attackers to change the password and privilege level of arbitrary accounts via the user parameter and modified (1) regpass and (2) level param...

4.6

CVE-2006-3608

Exploit
  • EPSS 3.61%
  • Veröffentlicht 18.07.2006 15:46:00
  • Zuletzt bearbeitet 03.04.2025 01:03:51

The Gallery module in Simone Vellei Flatnuke 2.5.7 and earlier, when Gallery uploads are enabled, does not restrict the extensions of uploaded files that begin with a GIF header, which allows remote authenticated users to execute arbitrary PHP code v...

4

CVE-2005-4449

Exploit
  • EPSS 3.29%
  • Veröffentlicht 21.12.2005 11:03:00
  • Zuletzt bearbeitet 03.04.2025 01:03:51

verify.php in FlatNuke 2.5.6 allows remote authenticated administrators to modify arbitrary PHP files by setting the file parameter to an arbitrary file and injecting the code into the body parameter. NOTE: if a FlatNuke administrator is normally as...

10

CVE-2005-4448

Exploit
  • EPSS 0.62%
  • Veröffentlicht 21.12.2005 11:03:00
  • Zuletzt bearbeitet 03.04.2025 01:03:51

FlatNuke 2.5.6 verifies authentication credentials based on an MD5 checksum of the admin name and the hashed password rather than the plaintext password, which allows attackers to gain privileges by obtaining the password hash (possibly via CVE-2005-...

5

CVE-2005-4208

Exploit
  • EPSS 2.16%
  • Veröffentlicht 13.12.2005 11:03:00
  • Zuletzt bearbeitet 03.04.2025 01:03:51

Directory traversal vulnerability in Flatnuke 2.5.6 allows remote attackers to access arbitrary files via a .. (dot dot) and null byte (%00) in the id parameter of the read module.

4.3

CVE-2005-3361

  • EPSS 0.34%
  • Veröffentlicht 28.10.2005 00:02:00
  • Zuletzt bearbeitet 03.04.2025 01:03:51

Cross-site scripting (XSS) vulnerability in forum/index.php in FlatNuke 2.5.6 allows remote attackers to inject arbitrary web script or HTML via the nome parameter in a login operation, a variant of CVE-2005-3306.

4.3

CVE-2005-3306

Exploit
  • EPSS 0.4%
  • Veröffentlicht 26.10.2005 01:02:00
  • Zuletzt bearbeitet 03.04.2025 01:03:51

Cross-site scripting (XSS) vulnerability in index.php for FlatNuke 2.5.6 allows remote attackers to inject arbitrary web script or HTML via the user parameter in a profile operation, a different vulnerability than CVE-2005-2814. NOTE: it is possible...

6.4

CVE-2005-2815

Exploit
  • EPSS 0.89%
  • Veröffentlicht 07.09.2005 18:03:00
  • Zuletzt bearbeitet 03.04.2025 01:03:51

print.php in FlatNuke 2.5.6 allows remote attackers to obtain sensitive information (path disclosure on error) or cause a denial of service (resource consumption) via an MS-DOS device name in the news parameter to print.php, such as (1) AUX, (2) CON,...

4.3

CVE-2005-2814

Exploit
  • EPSS 2.6%
  • Veröffentlicht 07.09.2005 18:03:00
  • Zuletzt bearbeitet 03.04.2025 01:03:51

Cross-site scripting (XSS) vulnerability in FlatNuke 2.5.6 allows remote attackers to inject arbitrary web script or HTML via the usr parameter in a vis_reg operation to index.php.

5

CVE-2005-2813

Exploit
  • EPSS 7.08%
  • Veröffentlicht 07.09.2005 18:03:00
  • Zuletzt bearbeitet 03.04.2025 01:03:51

Directory traversal vulnerability in FlatNuke 2.5.6 and possibly earlier allows remote attackers to read arbitrary files via ".." sequences and "%00" (trailing null byte) characters in the id parameter to the read mod in index.php.