Alstrasoft

Template Seller

6 vulnerabilities found.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
10

CVE-2007-2776

  • EPSS 1.35%
  • Published 21.05.2007 23:30:00
  • Last modified 09.04.2025 00:30:58

AlstraSoft Template Seller Pro 3.25 and earlier sends a redirect to the web browser but does not exit when administrative credentials are missing, which allows remote attackers to inject a credential variable setting and obtain administrative access ...

7.5

CVE-2007-2777

  • EPSS 1.38%
  • Published 21.05.2007 23:30:00
  • Last modified 09.04.2025 00:30:58

Unrestricted file upload vulnerability in admin/addsptemplate.php in AlstraSoft Template Seller Pro 3.25 and earlier allows remote attackers to execute arbitrary PHP code via an arbitrary .php filename in the zip parameter, which is created under spt...

7.5

CVE-2006-4591

Exploit
  • EPSS 0.58%
  • Published 06.09.2006 22:04:00
  • Last modified 03.04.2025 01:03:51

Multiple PHP remote file inclusion vulnerabilities in AlstraSoft Template Seller, and possibly AltraSoft Template Seller Pro 3.25, allow remote attackers to execute arbitrary PHP code via a URL in the config[template_path] parameter to (1) payment/pa...

4.3

CVE-2006-0222

Exploit
  • EPSS 0.42%
  • Published 16.01.2006 21:03:00
  • Last modified 03.04.2025 01:03:51

Cross-site scripting (XSS) vulnerability in fullview.php in AlstraSoft Template Seller Pro allows remote attackers to inject arbitrary web script or HTML via the tempid parameter.

7.5

CVE-2005-3797

Exploit
  • EPSS 3.73%
  • Published 24.11.2005 11:03:00
  • Last modified 03.04.2025 01:03:51

PHP remote file inclusion vulnerability in payment_paypal.php in AlstraSoft Template Seller Pro 3.25 allows remote attackers to execute arbitrary PHP code via the config[basepath] parameter.

7.5

CVE-2005-3798

  • EPSS 0.97%
  • Published 24.11.2005 11:03:00
  • Last modified 03.04.2025 01:03:51

SQL injection vulnerability in admin/index.php in AlstraSoft Template Seller Pro 3.25 allows remote attackers to execute arbitrary SQL commands via the username field.