Pixel Motion

Pixel Motion Blog

7 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
4.3

CVE-2008-1986

Exploit
  • EPSS 0.26%
  • Veröffentlicht 27.04.2008 21:05:00
  • Zuletzt bearbeitet 09.04.2025 00:30:58

Cross-site scripting (XSS) vulnerability in liste_article.php in Blog Pixel Motion (aka PixelMotion) allows remote attackers to inject arbitrary web script or HTML via the jours parameter.

9

CVE-2008-1866

Exploit
  • EPSS 15.11%
  • Veröffentlicht 17.04.2008 19:05:00
  • Zuletzt bearbeitet 09.04.2025 00:30:58

admin/modif_config.php in Blog Pixel Motion (aka PixelMotion) does not require admin authentication, which allows remote authenticated users to upload arbitrary PHP scripts in a ZIP archive, which is written to templateZip/ and then automatically ext...

7.5

CVE-2008-1867

Exploit
  • EPSS 0.41%
  • Veröffentlicht 17.04.2008 19:05:00
  • Zuletzt bearbeitet 09.04.2025 00:30:58

SQL injection vulnerability in Blog Pixel Motion (aka Blog PixelMotion) allows remote attackers to execute arbitrary SQL commands via the categorie parameter to index.php, possibly related to include/requetesIndex.php.

7.5

CVE-2008-1868

  • EPSS 4.66%
  • Veröffentlicht 17.04.2008 19:05:00
  • Zuletzt bearbeitet 09.04.2025 00:30:58

admin/sauvBase.php in Blog Pixel Motion (aka Blog PixelMotion) does not require authentication, which allows remote attackers to trigger a database backup dump, and obtain the resulting blogPM.sql file that contains sensitive information.

7.5

CVE-2006-5085

Exploit
  • EPSS 5.5%
  • Veröffentlicht 29.09.2006 00:07:00
  • Zuletzt bearbeitet 09.04.2025 00:30:58

Static code injection vulnerability in config.php in Blog Pixel Motion 2.1.1 allows remote attackers to execute arbitrary PHP code via the nom_blog parameter, which is injected into include/variables.php.

6.4

CVE-2006-5086

Exploit
  • EPSS 1.41%
  • Veröffentlicht 29.09.2006 00:07:00
  • Zuletzt bearbeitet 09.04.2025 00:30:58

Blog Pixel Motion 2.1.1 allows remote attackers to change the username and password for the admin user via a direct request to insere_base.php with modified (1) login and (2) pass parameters. NOTE: this issue was claimed to be SQL injection by the o...

7.5

CVE-2006-1426

Exploit
  • EPSS 2.08%
  • Veröffentlicht 28.03.2006 20:02:00
  • Zuletzt bearbeitet 03.04.2025 01:03:51

Multiple SQL injection vulnerabilities in Pixel Motion Blog allow remote attackers to execute arbitrary SQL commands via the (1) date parameter in index.php or bypass authentication via the (2) password parameter in admin/index.php.