Search criteria

18 vulnerabilities found for phpclanwebsite by phpclanwebsite

CVE-2008-5879 (GCVE-0-2008-5879)

Vulnerability from nvd – Published: 2009-01-08 19:00 – Updated: 2024-08-07 11:13
VLAI
Summary
Cross-site scripting (XSS) vulnerability in index.php in Phpclanwebsite (aka PCW) 1.23.3 Fix Pack 5 and earlier, allows remote attackers to inject arbitrary web script or HTML via the page parameter and other unspecified vectors.
Severity
No CVSS data available.
CWE
  • n/a
Assigner
References
URL Tags
http://securityreason.com/securityalert/4881 third-party-advisoryx_refsource_SREASON
https://www.exploit-db.com/exploits/7515 exploitx_refsource_EXPLOIT-DB
http://secunia.com/advisories/33211 third-party-advisoryx_refsource_SECUNIA
http://www.securityfocus.com/bid/32915 vdb-entryx_refsource_BID
Date Public
2008-12-18 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T11:13:13.047Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "4881",
            "tags": [
              "third-party-advisory",
              "x_refsource_SREASON",
              "x_transferred"
            ],
            "url": "http://securityreason.com/securityalert/4881"
          },
          {
            "name": "7515",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "https://www.exploit-db.com/exploits/7515"
          },
          {
            "name": "33211",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/33211"
          },
          {
            "name": "32915",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/32915"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2008-12-18T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site scripting (XSS) vulnerability in index.php in Phpclanwebsite (aka PCW) 1.23.3 Fix Pack 5 and earlier, allows remote attackers to inject arbitrary web script or HTML via the page parameter and other unspecified vectors."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-09-28T12:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "4881",
          "tags": [
            "third-party-advisory",
            "x_refsource_SREASON"
          ],
          "url": "http://securityreason.com/securityalert/4881"
        },
        {
          "name": "7515",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "https://www.exploit-db.com/exploits/7515"
        },
        {
          "name": "33211",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/33211"
        },
        {
          "name": "32915",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/32915"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2008-5879",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cross-site scripting (XSS) vulnerability in index.php in Phpclanwebsite (aka PCW) 1.23.3 Fix Pack 5 and earlier, allows remote attackers to inject arbitrary web script or HTML via the page parameter and other unspecified vectors."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "4881",
              "refsource": "SREASON",
              "url": "http://securityreason.com/securityalert/4881"
            },
            {
              "name": "7515",
              "refsource": "EXPLOIT-DB",
              "url": "https://www.exploit-db.com/exploits/7515"
            },
            {
              "name": "33211",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/33211"
            },
            {
              "name": "32915",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/32915"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2008-5879",
    "datePublished": "2009-01-08T19:00:00.000Z",
    "dateReserved": "2009-01-08T00:00:00.000Z",
    "dateUpdated": "2024-08-07T11:13:13.047Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2008-5878 (GCVE-0-2008-5878)

Vulnerability from nvd – Published: 2009-01-08 19:00 – Updated: 2024-08-07 11:13
VLAI
Summary
Multiple directory traversal vulnerabilities in Phpclanwebsite (aka PCW) 1.23.3 Fix Pack 5 and earlier, when magic_quotes_gpc is disabled and register_globals is enabled, allow remote attackers to include and execute arbitrary files via a .. (dot dot) in the (1) boxname parameter to theme/superchrome/box.php and the (2) theme parameter to phpclanwebsite/footer.php.
Severity
No CVSS data available.
CWE
  • n/a
Assigner
References
URL Tags
http://securityreason.com/securityalert/4881 third-party-advisoryx_refsource_SREASON
https://www.exploit-db.com/exploits/7515 exploitx_refsource_EXPLOIT-DB
http://secunia.com/advisories/33211 third-party-advisoryx_refsource_SECUNIA
http://www.securityfocus.com/bid/32915 vdb-entryx_refsource_BID
Date Public
2008-12-18 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T11:13:13.156Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "4881",
            "tags": [
              "third-party-advisory",
              "x_refsource_SREASON",
              "x_transferred"
            ],
            "url": "http://securityreason.com/securityalert/4881"
          },
          {
            "name": "7515",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "https://www.exploit-db.com/exploits/7515"
          },
          {
            "name": "33211",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/33211"
          },
          {
            "name": "32915",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/32915"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2008-12-18T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple directory traversal vulnerabilities in Phpclanwebsite (aka PCW) 1.23.3 Fix Pack 5 and earlier, when magic_quotes_gpc is disabled and register_globals is enabled, allow remote attackers to include and execute arbitrary files via a .. (dot dot) in the (1) boxname parameter to theme/superchrome/box.php and the (2) theme parameter to phpclanwebsite/footer.php."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-09-28T12:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "4881",
          "tags": [
            "third-party-advisory",
            "x_refsource_SREASON"
          ],
          "url": "http://securityreason.com/securityalert/4881"
        },
        {
          "name": "7515",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "https://www.exploit-db.com/exploits/7515"
        },
        {
          "name": "33211",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/33211"
        },
        {
          "name": "32915",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/32915"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2008-5878",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple directory traversal vulnerabilities in Phpclanwebsite (aka PCW) 1.23.3 Fix Pack 5 and earlier, when magic_quotes_gpc is disabled and register_globals is enabled, allow remote attackers to include and execute arbitrary files via a .. (dot dot) in the (1) boxname parameter to theme/superchrome/box.php and the (2) theme parameter to phpclanwebsite/footer.php."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "4881",
              "refsource": "SREASON",
              "url": "http://securityreason.com/securityalert/4881"
            },
            {
              "name": "7515",
              "refsource": "EXPLOIT-DB",
              "url": "https://www.exploit-db.com/exploits/7515"
            },
            {
              "name": "33211",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/33211"
            },
            {
              "name": "32915",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/32915"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2008-5878",
    "datePublished": "2009-01-08T19:00:00.000Z",
    "dateReserved": "2009-01-08T00:00:00.000Z",
    "dateUpdated": "2024-08-07T11:13:13.156Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2008-5877 (GCVE-0-2008-5877)

Vulnerability from nvd – Published: 2009-01-08 19:00 – Updated: 2024-08-07 11:13
VLAI
Summary
Multiple SQL injection vulnerabilities in Phpclanwebsite (aka PCW) 1.23.3 Fix Pack 5 and earlier, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) page parameter to index.php, (2) form_id parameter to pcw/processforms.php, (3) pcwlogin and (4) pcw_pass parameters to pcw/setlogin.php, (5) searchvalue parameter to pcw/downloads.php, and the (6) searchvalue and (7) whichfield parameter to pcw/downloads.php, a different vector than CVE-2006-0444.
Severity
No CVSS data available.
CWE
  • n/a
Assigner
References
URL Tags
http://securityreason.com/securityalert/4881 third-party-advisoryx_refsource_SREASON
https://www.exploit-db.com/exploits/7515 exploitx_refsource_EXPLOIT-DB
http://secunia.com/advisories/33211 third-party-advisoryx_refsource_SECUNIA
http://www.securityfocus.com/bid/32915 vdb-entryx_refsource_BID
Date Public
2008-12-18 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T11:13:13.120Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "4881",
            "tags": [
              "third-party-advisory",
              "x_refsource_SREASON",
              "x_transferred"
            ],
            "url": "http://securityreason.com/securityalert/4881"
          },
          {
            "name": "7515",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "https://www.exploit-db.com/exploits/7515"
          },
          {
            "name": "33211",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/33211"
          },
          {
            "name": "32915",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/32915"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2008-12-18T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple SQL injection vulnerabilities in Phpclanwebsite (aka PCW) 1.23.3 Fix Pack 5 and earlier, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) page parameter to index.php, (2) form_id parameter to pcw/processforms.php, (3) pcwlogin and (4) pcw_pass parameters to pcw/setlogin.php, (5) searchvalue parameter to pcw/downloads.php, and the (6) searchvalue and (7) whichfield parameter to pcw/downloads.php, a different vector than CVE-2006-0444."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-09-28T12:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "4881",
          "tags": [
            "third-party-advisory",
            "x_refsource_SREASON"
          ],
          "url": "http://securityreason.com/securityalert/4881"
        },
        {
          "name": "7515",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "https://www.exploit-db.com/exploits/7515"
        },
        {
          "name": "33211",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/33211"
        },
        {
          "name": "32915",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/32915"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2008-5877",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple SQL injection vulnerabilities in Phpclanwebsite (aka PCW) 1.23.3 Fix Pack 5 and earlier, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) page parameter to index.php, (2) form_id parameter to pcw/processforms.php, (3) pcwlogin and (4) pcw_pass parameters to pcw/setlogin.php, (5) searchvalue parameter to pcw/downloads.php, and the (6) searchvalue and (7) whichfield parameter to pcw/downloads.php, a different vector than CVE-2006-0444."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "4881",
              "refsource": "SREASON",
              "url": "http://securityreason.com/securityalert/4881"
            },
            {
              "name": "7515",
              "refsource": "EXPLOIT-DB",
              "url": "https://www.exploit-db.com/exploits/7515"
            },
            {
              "name": "33211",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/33211"
            },
            {
              "name": "32915",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/32915"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2008-5877",
    "datePublished": "2009-01-08T19:00:00.000Z",
    "dateReserved": "2009-01-08T00:00:00.000Z",
    "dateUpdated": "2024-08-07T11:13:13.120Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2006-0445 (GCVE-0-2006-0445)

Vulnerability from nvd – Published: 2006-01-26 22:00 – Updated: 2024-08-07 16:34
VLAI
Summary
index.php in Phpclanwebsite 1.23.1 allows remote authenticated users to obtain the installation path by specifying an invalid file name to the uploader page, as demonstrated by "\", which will display the full path of uploader.php. NOTE: this might be the result of a file inclusion vulnerability.
Severity
No CVSS data available.
CWE
  • n/a
Assigner
References
URL Tags
http://www.securityfocus.com/archive/1/423145/100… mailing-listx_refsource_BUGTRAQ
http://www.securityfocus.com/bid/16391 vdb-entryx_refsource_BID
http://www.h4cky0u.org/advisories/HYSA-2006-002-p… x_refsource_MISC
http://www.osvdb.org/22721 vdb-entryx_refsource_OSVDB
Date Public
2006-01-26 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T16:34:14.785Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "20060125 HYSA-2006-002 Phpclanwebsite 1.23.1 Multiple Vulnerabilities",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/423145/100/0/threaded"
          },
          {
            "name": "16391",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/16391"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.h4cky0u.org/advisories/HYSA-2006-002-phpclan.txt"
          },
          {
            "name": "22721",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://www.osvdb.org/22721"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2006-01-26T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "index.php in Phpclanwebsite 1.23.1 allows remote authenticated users to obtain the installation path by specifying an invalid file name to the uploader page, as demonstrated by \"\\\", which will display the full path of uploader.php.  NOTE: this might be the result of a file inclusion vulnerability."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-19T14:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "20060125 HYSA-2006-002 Phpclanwebsite 1.23.1 Multiple Vulnerabilities",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/423145/100/0/threaded"
        },
        {
          "name": "16391",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/16391"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.h4cky0u.org/advisories/HYSA-2006-002-phpclan.txt"
        },
        {
          "name": "22721",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://www.osvdb.org/22721"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2006-0445",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "index.php in Phpclanwebsite 1.23.1 allows remote authenticated users to obtain the installation path by specifying an invalid file name to the uploader page, as demonstrated by \"\\\", which will display the full path of uploader.php.  NOTE: this might be the result of a file inclusion vulnerability."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "20060125 HYSA-2006-002 Phpclanwebsite 1.23.1 Multiple Vulnerabilities",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/423145/100/0/threaded"
            },
            {
              "name": "16391",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/16391"
            },
            {
              "name": "http://www.h4cky0u.org/advisories/HYSA-2006-002-phpclan.txt",
              "refsource": "MISC",
              "url": "http://www.h4cky0u.org/advisories/HYSA-2006-002-phpclan.txt"
            },
            {
              "name": "22721",
              "refsource": "OSVDB",
              "url": "http://www.osvdb.org/22721"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2006-0445",
    "datePublished": "2006-01-26T22:00:00.000Z",
    "dateReserved": "2006-01-26T00:00:00.000Z",
    "dateUpdated": "2024-08-07T16:34:14.785Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2006-0444 (GCVE-0-2006-0444)

Vulnerability from nvd – Published: 2006-01-26 22:00 – Updated: 2024-08-07 16:34
VLAI
Summary
SQL injection vulnerability in index.php in Phpclanwebsite (aka PCW) 1.23.1 allows remote attackers to execute arbitrary SQL commands via the (1) par parameter in the post function on the forum page and possibly the (2) poll_id parameter on the poll page. NOTE: the poll_id vector can also allow resultant cross-site scripting (XSS) from an unquoted error message for invalid SQL syntax.
Severity
No CVSS data available.
CWE
  • n/a
Assigner
References
URL Tags
http://www.securityfocus.com/archive/1/423145/100… mailing-listx_refsource_BUGTRAQ
http://www.securityfocus.com/bid/16391 vdb-entryx_refsource_BID
http://www.h4cky0u.org/advisories/HYSA-2006-002-p… x_refsource_MISC
http://www.osvdb.org/22722 vdb-entryx_refsource_OSVDB
http://www.osvdb.org/22720 vdb-entryx_refsource_OSVDB
http://www.vupen.com/english/advisories/2006/0342 vdb-entryx_refsource_VUPEN
http://secunia.com/advisories/18597 third-party-advisoryx_refsource_SECUNIA
https://exchange.xforce.ibmcloud.com/vulnerabilit… vdb-entryx_refsource_XF
Date Public
2006-01-26 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T16:34:14.665Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "20060125 HYSA-2006-002 Phpclanwebsite 1.23.1 Multiple Vulnerabilities",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/423145/100/0/threaded"
          },
          {
            "name": "16391",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/16391"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.h4cky0u.org/advisories/HYSA-2006-002-phpclan.txt"
          },
          {
            "name": "22722",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://www.osvdb.org/22722"
          },
          {
            "name": "22720",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://www.osvdb.org/22720"
          },
          {
            "name": "ADV-2006-0342",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2006/0342"
          },
          {
            "name": "18597",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/18597"
          },
          {
            "name": "phpclanwebsite-index-sql-injection(24355)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24355"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2006-01-26T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "SQL injection vulnerability in index.php in Phpclanwebsite (aka PCW) 1.23.1 allows remote attackers to execute arbitrary SQL commands via the (1) par parameter in the post function on the forum page and possibly the (2) poll_id parameter on the poll page.  NOTE: the poll_id vector can also allow resultant cross-site scripting (XSS) from an unquoted error message for invalid SQL syntax."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-19T14:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "20060125 HYSA-2006-002 Phpclanwebsite 1.23.1 Multiple Vulnerabilities",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/423145/100/0/threaded"
        },
        {
          "name": "16391",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/16391"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.h4cky0u.org/advisories/HYSA-2006-002-phpclan.txt"
        },
        {
          "name": "22722",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://www.osvdb.org/22722"
        },
        {
          "name": "22720",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://www.osvdb.org/22720"
        },
        {
          "name": "ADV-2006-0342",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2006/0342"
        },
        {
          "name": "18597",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/18597"
        },
        {
          "name": "phpclanwebsite-index-sql-injection(24355)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24355"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2006-0444",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "SQL injection vulnerability in index.php in Phpclanwebsite (aka PCW) 1.23.1 allows remote attackers to execute arbitrary SQL commands via the (1) par parameter in the post function on the forum page and possibly the (2) poll_id parameter on the poll page.  NOTE: the poll_id vector can also allow resultant cross-site scripting (XSS) from an unquoted error message for invalid SQL syntax."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "20060125 HYSA-2006-002 Phpclanwebsite 1.23.1 Multiple Vulnerabilities",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/423145/100/0/threaded"
            },
            {
              "name": "16391",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/16391"
            },
            {
              "name": "http://www.h4cky0u.org/advisories/HYSA-2006-002-phpclan.txt",
              "refsource": "MISC",
              "url": "http://www.h4cky0u.org/advisories/HYSA-2006-002-phpclan.txt"
            },
            {
              "name": "22722",
              "refsource": "OSVDB",
              "url": "http://www.osvdb.org/22722"
            },
            {
              "name": "22720",
              "refsource": "OSVDB",
              "url": "http://www.osvdb.org/22720"
            },
            {
              "name": "ADV-2006-0342",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2006/0342"
            },
            {
              "name": "18597",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/18597"
            },
            {
              "name": "phpclanwebsite-index-sql-injection(24355)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24355"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2006-0444",
    "datePublished": "2006-01-26T22:00:00.000Z",
    "dateReserved": "2006-01-26T00:00:00.000Z",
    "dateUpdated": "2024-08-07T16:34:14.665Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2006-0366 (GCVE-0-2006-0366)

Vulnerability from nvd – Published: 2006-01-22 20:00 – Updated: 2024-08-07 16:34
VLAI
Summary
Cross-site scripting (XSS) vulnerability in Phpclanwebsite (aka PCW) allows remote attackers to inject arbitrary web script or HTML via a javascript URI in a BBCode img tag.
Severity
No CVSS data available.
CWE
  • n/a
Assigner
References
URL Tags
http://www.securityfocus.com/archive/1/422265/100… mailing-listx_refsource_BUGTRAQ
https://archive.cert.uni-stuttgart.de/bugtraq/200… mailing-listx_refsource_BUGTRAQ
http://www.securityfocus.com/bid/16300 vdb-entryx_refsource_BID
http://secunia.com/advisories/18541 third-party-advisoryx_refsource_SECUNIA
http://www.vupen.com/english/advisories/2006/0254 vdb-entryx_refsource_VUPEN
Date Public
2006-01-17 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T16:34:14.542Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "20060117 Phpclanwebsite BBCode IMG Tag XSS Vulnerability",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/422265/100/0/threaded"
          },
          {
            "name": "20060118 Phpclanwebsite BBCode IMG Tag XSS Vulnerability",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "https://archive.cert.uni-stuttgart.de/bugtraq/2006/01/msg00343.html"
          },
          {
            "name": "16300",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/16300"
          },
          {
            "name": "18541",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/18541"
          },
          {
            "name": "ADV-2006-0254",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2006/0254"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2006-01-17T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site scripting (XSS) vulnerability in Phpclanwebsite (aka PCW) allows remote attackers to inject arbitrary web script or HTML via a javascript URI in a BBCode img tag."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-19T14:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "20060117 Phpclanwebsite BBCode IMG Tag XSS Vulnerability",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/422265/100/0/threaded"
        },
        {
          "name": "20060118 Phpclanwebsite BBCode IMG Tag XSS Vulnerability",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "https://archive.cert.uni-stuttgart.de/bugtraq/2006/01/msg00343.html"
        },
        {
          "name": "16300",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/16300"
        },
        {
          "name": "18541",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/18541"
        },
        {
          "name": "ADV-2006-0254",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2006/0254"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2006-0366",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cross-site scripting (XSS) vulnerability in Phpclanwebsite (aka PCW) allows remote attackers to inject arbitrary web script or HTML via a javascript URI in a BBCode img tag."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "20060117 Phpclanwebsite BBCode IMG Tag XSS Vulnerability",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/422265/100/0/threaded"
            },
            {
              "name": "20060118 Phpclanwebsite BBCode IMG Tag XSS Vulnerability",
              "refsource": "BUGTRAQ",
              "url": "https://archive.cert.uni-stuttgart.de/bugtraq/2006/01/msg00343.html"
            },
            {
              "name": "16300",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/16300"
            },
            {
              "name": "18541",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/18541"
            },
            {
              "name": "ADV-2006-0254",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2006/0254"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2006-0366",
    "datePublished": "2006-01-22T20:00:00.000Z",
    "dateReserved": "2006-01-22T00:00:00.000Z",
    "dateUpdated": "2024-08-07T16:34:14.542Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

FKIE_CVE-2008-5877

Vulnerability from fkie_nvd - Published: 2009-01-08 19:30 - Updated: 2026-04-23 00:35
Severity
Summary
Multiple SQL injection vulnerabilities in Phpclanwebsite (aka PCW) 1.23.3 Fix Pack 5 and earlier, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) page parameter to index.php, (2) form_id parameter to pcw/processforms.php, (3) pcwlogin and (4) pcw_pass parameters to pcw/setlogin.php, (5) searchvalue parameter to pcw/downloads.php, and the (6) searchvalue and (7) whichfield parameter to pcw/downloads.php, a different vector than CVE-2006-0444.
References
cve@mitre.orghttp://secunia.com/advisories/33211Vendor Advisory
cve@mitre.orghttp://securityreason.com/securityalert/4881
cve@mitre.orghttp://www.securityfocus.com/bid/32915Exploit
cve@mitre.orghttps://www.exploit-db.com/exploits/7515
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/33211Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://securityreason.com/securityalert/4881
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/32915Exploit
af854a3a-2127-422b-91ae-364da2661108https://www.exploit-db.com/exploits/7515
Impacted products
Vendor Product Version
phpclanwebsite phpclanwebsite *
phpclanwebsite phpclanwebsite 1.20
phpclanwebsite phpclanwebsite 1.21
phpclanwebsite phpclanwebsite 1.22
phpclanwebsite phpclanwebsite 1.23
phpclanwebsite phpclanwebsite 1.23.1
phpclanwebsite phpclanwebsite 1.23.2
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:phpclanwebsite:phpclanwebsite:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "6A6ECD70-4B60-4909-BC08-BBBB35862B6A",
              "versionEndIncluding": "1.23.3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:phpclanwebsite:phpclanwebsite:1.20:*:*:*:*:*:*:*",
              "matchCriteriaId": "4D54B323-8B6A-4887-9AE1-F41F3C759097",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:phpclanwebsite:phpclanwebsite:1.21:*:*:*:*:*:*:*",
              "matchCriteriaId": "39FB03FF-F7E2-40CA-9CA6-C9C843544C0E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:phpclanwebsite:phpclanwebsite:1.22:*:*:*:*:*:*:*",
              "matchCriteriaId": "C33D45DB-62D9-4670-8886-A41377DFE6E1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:phpclanwebsite:phpclanwebsite:1.23:*:*:*:*:*:*:*",
              "matchCriteriaId": "C0F5C73A-23EE-4126-B5DA-7A22E3843690",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:phpclanwebsite:phpclanwebsite:1.23.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "0F83CDE4-12C0-42AF-8F4E-E383791BA81A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:phpclanwebsite:phpclanwebsite:1.23.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "AF21339E-C9C6-453B-8EEE-CB3325FFA5DF",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple SQL injection vulnerabilities in Phpclanwebsite (aka PCW) 1.23.3 Fix Pack 5 and earlier, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) page parameter to index.php, (2) form_id parameter to pcw/processforms.php, (3) pcwlogin and (4) pcw_pass parameters to pcw/setlogin.php, (5) searchvalue parameter to pcw/downloads.php, and the (6) searchvalue and (7) whichfield parameter to pcw/downloads.php, a different vector than CVE-2006-0444."
    },
    {
      "lang": "es",
      "value": "M\u00faltiples vulnerabilidades de inyecci\u00f3n SQL en Phpclanwebsite (tambi\u00e9n conocido como PCW) v1.23.3 Fix Pack 5 y versiones anteriores, cuando magic_quotes_gpc no est\u00e1 activo, permiten a atacantes remotos ejecutar comandos SQL de su elecci\u00f3n a trav\u00e9s del par\u00e1metro (1) page de index.php, par\u00e1metro (2) form_id de pcw/processforms.php, par\u00e1metros (3) pcwlogin y (4) pcw_pass de pcw/setlogin.php, par\u00e1metro (5) searchvalue de pcw/downloads.php, y los par\u00e1metros (6) searchvalue y (7) whichfield de pcw/downloads.php, un vector diferente que CVE-2006-0444."
    }
  ],
  "id": "CVE-2008-5877",
  "lastModified": "2026-04-23T00:35:47.467",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.8,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": true,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2009-01-08T19:30:11.170",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/33211"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://securityreason.com/securityalert/4881"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.securityfocus.com/bid/32915"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://www.exploit-db.com/exploits/7515"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/33211"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://securityreason.com/securityalert/4881"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.securityfocus.com/bid/32915"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.exploit-db.com/exploits/7515"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

FKIE_CVE-2008-5878

Vulnerability from fkie_nvd - Published: 2009-01-08 19:30 - Updated: 2026-04-23 00:35
Severity
Summary
Multiple directory traversal vulnerabilities in Phpclanwebsite (aka PCW) 1.23.3 Fix Pack 5 and earlier, when magic_quotes_gpc is disabled and register_globals is enabled, allow remote attackers to include and execute arbitrary files via a .. (dot dot) in the (1) boxname parameter to theme/superchrome/box.php and the (2) theme parameter to phpclanwebsite/footer.php.
References
cve@mitre.orghttp://secunia.com/advisories/33211Vendor Advisory
cve@mitre.orghttp://securityreason.com/securityalert/4881
cve@mitre.orghttp://www.securityfocus.com/bid/32915Exploit
cve@mitre.orghttps://www.exploit-db.com/exploits/7515
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/33211Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://securityreason.com/securityalert/4881
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/32915Exploit
af854a3a-2127-422b-91ae-364da2661108https://www.exploit-db.com/exploits/7515
Impacted products
Vendor Product Version
phpclanwebsite phpclanwebsite *
phpclanwebsite phpclanwebsite 1.20
phpclanwebsite phpclanwebsite 1.21
phpclanwebsite phpclanwebsite 1.22
phpclanwebsite phpclanwebsite 1.23
phpclanwebsite phpclanwebsite 1.23.1
phpclanwebsite phpclanwebsite 1.23.2
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:phpclanwebsite:phpclanwebsite:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "6A6ECD70-4B60-4909-BC08-BBBB35862B6A",
              "versionEndIncluding": "1.23.3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:phpclanwebsite:phpclanwebsite:1.20:*:*:*:*:*:*:*",
              "matchCriteriaId": "4D54B323-8B6A-4887-9AE1-F41F3C759097",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:phpclanwebsite:phpclanwebsite:1.21:*:*:*:*:*:*:*",
              "matchCriteriaId": "39FB03FF-F7E2-40CA-9CA6-C9C843544C0E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:phpclanwebsite:phpclanwebsite:1.22:*:*:*:*:*:*:*",
              "matchCriteriaId": "C33D45DB-62D9-4670-8886-A41377DFE6E1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:phpclanwebsite:phpclanwebsite:1.23:*:*:*:*:*:*:*",
              "matchCriteriaId": "C0F5C73A-23EE-4126-B5DA-7A22E3843690",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:phpclanwebsite:phpclanwebsite:1.23.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "0F83CDE4-12C0-42AF-8F4E-E383791BA81A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:phpclanwebsite:phpclanwebsite:1.23.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "AF21339E-C9C6-453B-8EEE-CB3325FFA5DF",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple directory traversal vulnerabilities in Phpclanwebsite (aka PCW) 1.23.3 Fix Pack 5 and earlier, when magic_quotes_gpc is disabled and register_globals is enabled, allow remote attackers to include and execute arbitrary files via a .. (dot dot) in the (1) boxname parameter to theme/superchrome/box.php and the (2) theme parameter to phpclanwebsite/footer.php."
    },
    {
      "lang": "es",
      "value": "M\u00faltiples vulnerabilidades de salto de directorio en Phpclanwebsite (tambi\u00e9n conocido como PCW) v1.23.3 Fix Pack 5 y versiones anteriores, cuando magic_quotes_gpc no est\u00e1 activo y register_globals est\u00e1 activo, permiten a atacantes remotos incluir y ejecutar ficheros de su elecci\u00f3n a trav\u00e9s de .. (punto punto) en el par\u00e1metro (1) boxname de theme/superchrome/box.php y el par\u00e1metro (2) theme de phpclanwebsite/footer.php."
    }
  ],
  "id": "CVE-2008-5878",
  "lastModified": "2026-04-23T00:35:47.467",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "HIGH",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 5.1,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 4.9,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": true,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2009-01-08T19:30:11.187",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/33211"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://securityreason.com/securityalert/4881"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.securityfocus.com/bid/32915"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://www.exploit-db.com/exploits/7515"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/33211"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://securityreason.com/securityalert/4881"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.securityfocus.com/bid/32915"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.exploit-db.com/exploits/7515"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

FKIE_CVE-2008-5879

Vulnerability from fkie_nvd - Published: 2009-01-08 19:30 - Updated: 2026-04-23 00:35
Severity
Summary
Cross-site scripting (XSS) vulnerability in index.php in Phpclanwebsite (aka PCW) 1.23.3 Fix Pack 5 and earlier, allows remote attackers to inject arbitrary web script or HTML via the page parameter and other unspecified vectors.
References
cve@mitre.orghttp://secunia.com/advisories/33211Vendor Advisory
cve@mitre.orghttp://securityreason.com/securityalert/4881
cve@mitre.orghttp://www.securityfocus.com/bid/32915Exploit
cve@mitre.orghttps://www.exploit-db.com/exploits/7515
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/33211Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://securityreason.com/securityalert/4881
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/32915Exploit
af854a3a-2127-422b-91ae-364da2661108https://www.exploit-db.com/exploits/7515
Impacted products
Vendor Product Version
phpclanwebsite phpclanwebsite *
phpclanwebsite phpclanwebsite 1.20
phpclanwebsite phpclanwebsite 1.21
phpclanwebsite phpclanwebsite 1.22
phpclanwebsite phpclanwebsite 1.23
phpclanwebsite phpclanwebsite 1.23.1
phpclanwebsite phpclanwebsite 1.23.2
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:phpclanwebsite:phpclanwebsite:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "6A6ECD70-4B60-4909-BC08-BBBB35862B6A",
              "versionEndIncluding": "1.23.3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:phpclanwebsite:phpclanwebsite:1.20:*:*:*:*:*:*:*",
              "matchCriteriaId": "4D54B323-8B6A-4887-9AE1-F41F3C759097",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:phpclanwebsite:phpclanwebsite:1.21:*:*:*:*:*:*:*",
              "matchCriteriaId": "39FB03FF-F7E2-40CA-9CA6-C9C843544C0E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:phpclanwebsite:phpclanwebsite:1.22:*:*:*:*:*:*:*",
              "matchCriteriaId": "C33D45DB-62D9-4670-8886-A41377DFE6E1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:phpclanwebsite:phpclanwebsite:1.23:*:*:*:*:*:*:*",
              "matchCriteriaId": "C0F5C73A-23EE-4126-B5DA-7A22E3843690",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:phpclanwebsite:phpclanwebsite:1.23.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "0F83CDE4-12C0-42AF-8F4E-E383791BA81A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:phpclanwebsite:phpclanwebsite:1.23.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "AF21339E-C9C6-453B-8EEE-CB3325FFA5DF",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-site scripting (XSS) vulnerability in index.php in Phpclanwebsite (aka PCW) 1.23.3 Fix Pack 5 and earlier, allows remote attackers to inject arbitrary web script or HTML via the page parameter and other unspecified vectors."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de secuencias de comandos en sitios cruzados en index.php en Phpclanwebsite (tambi\u00e9n conocido como PCW) v1.23.3 Fix Pack 5 y versiones anteriores, permite a atacantes remotos inyectar web script o HTML a trav\u00e9s del par\u00e1metro \"page\" y otros vectores no especificados."
    }
  ],
  "id": "CVE-2008-5879",
  "lastModified": "2026-04-23T00:35:47.467",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ]
  },
  "published": "2009-01-08T19:30:11.217",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/33211"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://securityreason.com/securityalert/4881"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.securityfocus.com/bid/32915"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://www.exploit-db.com/exploits/7515"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/33211"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://securityreason.com/securityalert/4881"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.securityfocus.com/bid/32915"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.exploit-db.com/exploits/7515"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

FKIE_CVE-2006-0444

Vulnerability from fkie_nvd - Published: 2006-01-26 22:03 - Updated: 2026-04-16 00:27
Severity
Summary
SQL injection vulnerability in index.php in Phpclanwebsite (aka PCW) 1.23.1 allows remote attackers to execute arbitrary SQL commands via the (1) par parameter in the post function on the forum page and possibly the (2) poll_id parameter on the poll page. NOTE: the poll_id vector can also allow resultant cross-site scripting (XSS) from an unquoted error message for invalid SQL syntax.
References
cve@mitre.orghttp://secunia.com/advisories/18597Patch, Vendor Advisory
cve@mitre.orghttp://www.h4cky0u.org/advisories/HYSA-2006-002-phpclan.txtExploit, Vendor Advisory
cve@mitre.orghttp://www.osvdb.org/22720
cve@mitre.orghttp://www.osvdb.org/22722
cve@mitre.orghttp://www.securityfocus.com/archive/1/423145/100/0/threaded
cve@mitre.orghttp://www.securityfocus.com/bid/16391Patch
cve@mitre.orghttp://www.vupen.com/english/advisories/2006/0342
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/24355
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/18597Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.h4cky0u.org/advisories/HYSA-2006-002-phpclan.txtExploit, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.osvdb.org/22720
af854a3a-2127-422b-91ae-364da2661108http://www.osvdb.org/22722
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/archive/1/423145/100/0/threaded
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/16391Patch
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2006/0342
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/24355
Impacted products
Vendor Product Version
phpclanwebsite phpclanwebsite 1.23.1
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:phpclanwebsite:phpclanwebsite:1.23.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "0F83CDE4-12C0-42AF-8F4E-E383791BA81A",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "SQL injection vulnerability in index.php in Phpclanwebsite (aka PCW) 1.23.1 allows remote attackers to execute arbitrary SQL commands via the (1) par parameter in the post function on the forum page and possibly the (2) poll_id parameter on the poll page.  NOTE: the poll_id vector can also allow resultant cross-site scripting (XSS) from an unquoted error message for invalid SQL syntax."
    }
  ],
  "evaluatorSolution": "A simple fix has been released on the Main PCW site available directly at \u003ca href=\"http://www.phpclanwebsite.com/index.php?page=downloads\u0026func=browselist\u0026par=1\"\u003ehttp://www.phpclanwebsite.com/index.php?page=downloads\u0026func=browselist\u0026par=1\u003c/a\u003e\r\nPlease download and install imediately.\r\nTech note: Filters id number (par) to contain numbers only.\r\n",
  "id": "CVE-2006-0444",
  "lastModified": "2026-04-16T00:27:16.627",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.8,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": true,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2006-01-26T22:03:00.000",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/18597"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "http://www.h4cky0u.org/advisories/HYSA-2006-002-phpclan.txt"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.osvdb.org/22720"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.osvdb.org/22722"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/archive/1/423145/100/0/threaded"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch"
      ],
      "url": "http://www.securityfocus.com/bid/16391"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.vupen.com/english/advisories/2006/0342"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24355"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/18597"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "http://www.h4cky0u.org/advisories/HYSA-2006-002-phpclan.txt"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.osvdb.org/22720"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.osvdb.org/22722"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/423145/100/0/threaded"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://www.securityfocus.com/bid/16391"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vupen.com/english/advisories/2006/0342"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24355"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

FKIE_CVE-2006-0445

Vulnerability from fkie_nvd - Published: 2006-01-26 22:03 - Updated: 2026-04-16 00:27
Severity
Summary
index.php in Phpclanwebsite 1.23.1 allows remote authenticated users to obtain the installation path by specifying an invalid file name to the uploader page, as demonstrated by "\", which will display the full path of uploader.php. NOTE: this might be the result of a file inclusion vulnerability.
References
cve@mitre.orghttp://www.h4cky0u.org/advisories/HYSA-2006-002-phpclan.txtExploit, Vendor Advisory
cve@mitre.orghttp://www.osvdb.org/22721
cve@mitre.orghttp://www.securityfocus.com/archive/1/423145/100/0/threaded
cve@mitre.orghttp://www.securityfocus.com/bid/16391
af854a3a-2127-422b-91ae-364da2661108http://www.h4cky0u.org/advisories/HYSA-2006-002-phpclan.txtExploit, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.osvdb.org/22721
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/archive/1/423145/100/0/threaded
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/16391
Impacted products
Vendor Product Version
phpclanwebsite phpclanwebsite 1.23.1
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:phpclanwebsite:phpclanwebsite:1.23.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "0F83CDE4-12C0-42AF-8F4E-E383791BA81A",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "index.php in Phpclanwebsite 1.23.1 allows remote authenticated users to obtain the installation path by specifying an invalid file name to the uploader page, as demonstrated by \"\\\", which will display the full path of uploader.php.  NOTE: this might be the result of a file inclusion vulnerability."
    }
  ],
  "evaluatorSolution": "Please add the following to the config.php file to avoid all such exploits.\r\n\r\nini_set(\u0027display_errors\u0027, false);\r\n",
  "id": "CVE-2006-0445",
  "lastModified": "2026-04-16T00:27:16.627",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "NONE",
          "baseScore": 4.0,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2006-01-26T22:03:00.000",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "http://www.h4cky0u.org/advisories/HYSA-2006-002-phpclan.txt"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.osvdb.org/22721"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/archive/1/423145/100/0/threaded"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/16391"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "http://www.h4cky0u.org/advisories/HYSA-2006-002-phpclan.txt"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.osvdb.org/22721"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/423145/100/0/threaded"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/16391"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

FKIE_CVE-2006-0366

Vulnerability from fkie_nvd - Published: 2006-01-22 20:03 - Updated: 2026-04-16 00:27
Severity
Summary
Cross-site scripting (XSS) vulnerability in Phpclanwebsite (aka PCW) allows remote attackers to inject arbitrary web script or HTML via a javascript URI in a BBCode img tag.
References
cve@mitre.orghttp://secunia.com/advisories/18541Patch, Vendor Advisory
cve@mitre.orghttp://www.securityfocus.com/archive/1/422265/100/0/threaded
cve@mitre.orghttp://www.securityfocus.com/bid/16300Patch
cve@mitre.orghttp://www.vupen.com/english/advisories/2006/0254
cve@mitre.orghttps://archive.cert.uni-stuttgart.de/bugtraq/2006/01/msg00343.html
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/18541Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/archive/1/422265/100/0/threaded
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/16300Patch
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2006/0254
af854a3a-2127-422b-91ae-364da2661108https://archive.cert.uni-stuttgart.de/bugtraq/2006/01/msg00343.html
Impacted products
Vendor Product Version
phpclanwebsite phpclanwebsite 1.23.1
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:phpclanwebsite:phpclanwebsite:1.23.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "0F83CDE4-12C0-42AF-8F4E-E383791BA81A",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-site scripting (XSS) vulnerability in Phpclanwebsite (aka PCW) allows remote attackers to inject arbitrary web script or HTML via a javascript URI in a BBCode img tag."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de XSS en Phpclanwebsite (tambi\u00e9n conocido como PCW) permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a trav\u00e9s de una URI javascript en una etiqueta BBCode img."
    }
  ],
  "evaluatorSolution": "A simple fix has been released on the Main PCW site available directly at \u003ca href=\"http://www.phpclanwebsite.com/index.php?page=downloads\u0026func=browselist\u0026par=1\"\u003ehttp://www.phpclanwebsite.com/index.php?page=downloads\u0026func=browselist\u0026par=1\r\n\u003c/a\u003ePlease download and install imediately.",
  "id": "CVE-2006-0366",
  "lastModified": "2026-04-16T00:27:16.627",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2006-01-22T20:03:00.000",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/18541"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/archive/1/422265/100/0/threaded"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch"
      ],
      "url": "http://www.securityfocus.com/bid/16300"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.vupen.com/english/advisories/2006/0254"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://archive.cert.uni-stuttgart.de/bugtraq/2006/01/msg00343.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/18541"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/422265/100/0/threaded"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://www.securityfocus.com/bid/16300"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vupen.com/english/advisories/2006/0254"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://archive.cert.uni-stuttgart.de/bugtraq/2006/01/msg00343.html"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

CVE-2008-5878 (GCVE-0-2008-5878)

Vulnerability from cvelistv5 – Published: 2009-01-08 19:00 – Updated: 2024-08-07 11:13
VLAI
Summary
Multiple directory traversal vulnerabilities in Phpclanwebsite (aka PCW) 1.23.3 Fix Pack 5 and earlier, when magic_quotes_gpc is disabled and register_globals is enabled, allow remote attackers to include and execute arbitrary files via a .. (dot dot) in the (1) boxname parameter to theme/superchrome/box.php and the (2) theme parameter to phpclanwebsite/footer.php.
Severity
No CVSS data available.
CWE
  • n/a
Assigner
References
URL Tags
http://securityreason.com/securityalert/4881 third-party-advisoryx_refsource_SREASON
https://www.exploit-db.com/exploits/7515 exploitx_refsource_EXPLOIT-DB
http://secunia.com/advisories/33211 third-party-advisoryx_refsource_SECUNIA
http://www.securityfocus.com/bid/32915 vdb-entryx_refsource_BID
Date Public
2008-12-18 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T11:13:13.156Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "4881",
            "tags": [
              "third-party-advisory",
              "x_refsource_SREASON",
              "x_transferred"
            ],
            "url": "http://securityreason.com/securityalert/4881"
          },
          {
            "name": "7515",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "https://www.exploit-db.com/exploits/7515"
          },
          {
            "name": "33211",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/33211"
          },
          {
            "name": "32915",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/32915"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2008-12-18T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple directory traversal vulnerabilities in Phpclanwebsite (aka PCW) 1.23.3 Fix Pack 5 and earlier, when magic_quotes_gpc is disabled and register_globals is enabled, allow remote attackers to include and execute arbitrary files via a .. (dot dot) in the (1) boxname parameter to theme/superchrome/box.php and the (2) theme parameter to phpclanwebsite/footer.php."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-09-28T12:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "4881",
          "tags": [
            "third-party-advisory",
            "x_refsource_SREASON"
          ],
          "url": "http://securityreason.com/securityalert/4881"
        },
        {
          "name": "7515",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "https://www.exploit-db.com/exploits/7515"
        },
        {
          "name": "33211",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/33211"
        },
        {
          "name": "32915",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/32915"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2008-5878",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple directory traversal vulnerabilities in Phpclanwebsite (aka PCW) 1.23.3 Fix Pack 5 and earlier, when magic_quotes_gpc is disabled and register_globals is enabled, allow remote attackers to include and execute arbitrary files via a .. (dot dot) in the (1) boxname parameter to theme/superchrome/box.php and the (2) theme parameter to phpclanwebsite/footer.php."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "4881",
              "refsource": "SREASON",
              "url": "http://securityreason.com/securityalert/4881"
            },
            {
              "name": "7515",
              "refsource": "EXPLOIT-DB",
              "url": "https://www.exploit-db.com/exploits/7515"
            },
            {
              "name": "33211",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/33211"
            },
            {
              "name": "32915",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/32915"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2008-5878",
    "datePublished": "2009-01-08T19:00:00.000Z",
    "dateReserved": "2009-01-08T00:00:00.000Z",
    "dateUpdated": "2024-08-07T11:13:13.156Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2008-5879 (GCVE-0-2008-5879)

Vulnerability from cvelistv5 – Published: 2009-01-08 19:00 – Updated: 2024-08-07 11:13
VLAI
Summary
Cross-site scripting (XSS) vulnerability in index.php in Phpclanwebsite (aka PCW) 1.23.3 Fix Pack 5 and earlier, allows remote attackers to inject arbitrary web script or HTML via the page parameter and other unspecified vectors.
Severity
No CVSS data available.
CWE
  • n/a
Assigner
References
URL Tags
http://securityreason.com/securityalert/4881 third-party-advisoryx_refsource_SREASON
https://www.exploit-db.com/exploits/7515 exploitx_refsource_EXPLOIT-DB
http://secunia.com/advisories/33211 third-party-advisoryx_refsource_SECUNIA
http://www.securityfocus.com/bid/32915 vdb-entryx_refsource_BID
Date Public
2008-12-18 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T11:13:13.047Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "4881",
            "tags": [
              "third-party-advisory",
              "x_refsource_SREASON",
              "x_transferred"
            ],
            "url": "http://securityreason.com/securityalert/4881"
          },
          {
            "name": "7515",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "https://www.exploit-db.com/exploits/7515"
          },
          {
            "name": "33211",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/33211"
          },
          {
            "name": "32915",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/32915"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2008-12-18T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site scripting (XSS) vulnerability in index.php in Phpclanwebsite (aka PCW) 1.23.3 Fix Pack 5 and earlier, allows remote attackers to inject arbitrary web script or HTML via the page parameter and other unspecified vectors."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-09-28T12:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "4881",
          "tags": [
            "third-party-advisory",
            "x_refsource_SREASON"
          ],
          "url": "http://securityreason.com/securityalert/4881"
        },
        {
          "name": "7515",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "https://www.exploit-db.com/exploits/7515"
        },
        {
          "name": "33211",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/33211"
        },
        {
          "name": "32915",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/32915"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2008-5879",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cross-site scripting (XSS) vulnerability in index.php in Phpclanwebsite (aka PCW) 1.23.3 Fix Pack 5 and earlier, allows remote attackers to inject arbitrary web script or HTML via the page parameter and other unspecified vectors."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "4881",
              "refsource": "SREASON",
              "url": "http://securityreason.com/securityalert/4881"
            },
            {
              "name": "7515",
              "refsource": "EXPLOIT-DB",
              "url": "https://www.exploit-db.com/exploits/7515"
            },
            {
              "name": "33211",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/33211"
            },
            {
              "name": "32915",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/32915"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2008-5879",
    "datePublished": "2009-01-08T19:00:00.000Z",
    "dateReserved": "2009-01-08T00:00:00.000Z",
    "dateUpdated": "2024-08-07T11:13:13.047Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2008-5877 (GCVE-0-2008-5877)

Vulnerability from cvelistv5 – Published: 2009-01-08 19:00 – Updated: 2024-08-07 11:13
VLAI
Summary
Multiple SQL injection vulnerabilities in Phpclanwebsite (aka PCW) 1.23.3 Fix Pack 5 and earlier, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) page parameter to index.php, (2) form_id parameter to pcw/processforms.php, (3) pcwlogin and (4) pcw_pass parameters to pcw/setlogin.php, (5) searchvalue parameter to pcw/downloads.php, and the (6) searchvalue and (7) whichfield parameter to pcw/downloads.php, a different vector than CVE-2006-0444.
Severity
No CVSS data available.
CWE
  • n/a
Assigner
References
URL Tags
http://securityreason.com/securityalert/4881 third-party-advisoryx_refsource_SREASON
https://www.exploit-db.com/exploits/7515 exploitx_refsource_EXPLOIT-DB
http://secunia.com/advisories/33211 third-party-advisoryx_refsource_SECUNIA
http://www.securityfocus.com/bid/32915 vdb-entryx_refsource_BID
Date Public
2008-12-18 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T11:13:13.120Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "4881",
            "tags": [
              "third-party-advisory",
              "x_refsource_SREASON",
              "x_transferred"
            ],
            "url": "http://securityreason.com/securityalert/4881"
          },
          {
            "name": "7515",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "https://www.exploit-db.com/exploits/7515"
          },
          {
            "name": "33211",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/33211"
          },
          {
            "name": "32915",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/32915"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2008-12-18T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple SQL injection vulnerabilities in Phpclanwebsite (aka PCW) 1.23.3 Fix Pack 5 and earlier, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) page parameter to index.php, (2) form_id parameter to pcw/processforms.php, (3) pcwlogin and (4) pcw_pass parameters to pcw/setlogin.php, (5) searchvalue parameter to pcw/downloads.php, and the (6) searchvalue and (7) whichfield parameter to pcw/downloads.php, a different vector than CVE-2006-0444."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-09-28T12:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "4881",
          "tags": [
            "third-party-advisory",
            "x_refsource_SREASON"
          ],
          "url": "http://securityreason.com/securityalert/4881"
        },
        {
          "name": "7515",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "https://www.exploit-db.com/exploits/7515"
        },
        {
          "name": "33211",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/33211"
        },
        {
          "name": "32915",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/32915"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2008-5877",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple SQL injection vulnerabilities in Phpclanwebsite (aka PCW) 1.23.3 Fix Pack 5 and earlier, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) page parameter to index.php, (2) form_id parameter to pcw/processforms.php, (3) pcwlogin and (4) pcw_pass parameters to pcw/setlogin.php, (5) searchvalue parameter to pcw/downloads.php, and the (6) searchvalue and (7) whichfield parameter to pcw/downloads.php, a different vector than CVE-2006-0444."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "4881",
              "refsource": "SREASON",
              "url": "http://securityreason.com/securityalert/4881"
            },
            {
              "name": "7515",
              "refsource": "EXPLOIT-DB",
              "url": "https://www.exploit-db.com/exploits/7515"
            },
            {
              "name": "33211",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/33211"
            },
            {
              "name": "32915",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/32915"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2008-5877",
    "datePublished": "2009-01-08T19:00:00.000Z",
    "dateReserved": "2009-01-08T00:00:00.000Z",
    "dateUpdated": "2024-08-07T11:13:13.120Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2006-0445 (GCVE-0-2006-0445)

Vulnerability from cvelistv5 – Published: 2006-01-26 22:00 – Updated: 2024-08-07 16:34
VLAI
Summary
index.php in Phpclanwebsite 1.23.1 allows remote authenticated users to obtain the installation path by specifying an invalid file name to the uploader page, as demonstrated by "\", which will display the full path of uploader.php. NOTE: this might be the result of a file inclusion vulnerability.
Severity
No CVSS data available.
CWE
  • n/a
Assigner
References
URL Tags
http://www.securityfocus.com/archive/1/423145/100… mailing-listx_refsource_BUGTRAQ
http://www.securityfocus.com/bid/16391 vdb-entryx_refsource_BID
http://www.h4cky0u.org/advisories/HYSA-2006-002-p… x_refsource_MISC
http://www.osvdb.org/22721 vdb-entryx_refsource_OSVDB
Date Public
2006-01-26 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T16:34:14.785Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "20060125 HYSA-2006-002 Phpclanwebsite 1.23.1 Multiple Vulnerabilities",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/423145/100/0/threaded"
          },
          {
            "name": "16391",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/16391"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.h4cky0u.org/advisories/HYSA-2006-002-phpclan.txt"
          },
          {
            "name": "22721",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://www.osvdb.org/22721"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2006-01-26T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "index.php in Phpclanwebsite 1.23.1 allows remote authenticated users to obtain the installation path by specifying an invalid file name to the uploader page, as demonstrated by \"\\\", which will display the full path of uploader.php.  NOTE: this might be the result of a file inclusion vulnerability."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-19T14:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "20060125 HYSA-2006-002 Phpclanwebsite 1.23.1 Multiple Vulnerabilities",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/423145/100/0/threaded"
        },
        {
          "name": "16391",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/16391"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.h4cky0u.org/advisories/HYSA-2006-002-phpclan.txt"
        },
        {
          "name": "22721",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://www.osvdb.org/22721"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2006-0445",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "index.php in Phpclanwebsite 1.23.1 allows remote authenticated users to obtain the installation path by specifying an invalid file name to the uploader page, as demonstrated by \"\\\", which will display the full path of uploader.php.  NOTE: this might be the result of a file inclusion vulnerability."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "20060125 HYSA-2006-002 Phpclanwebsite 1.23.1 Multiple Vulnerabilities",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/423145/100/0/threaded"
            },
            {
              "name": "16391",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/16391"
            },
            {
              "name": "http://www.h4cky0u.org/advisories/HYSA-2006-002-phpclan.txt",
              "refsource": "MISC",
              "url": "http://www.h4cky0u.org/advisories/HYSA-2006-002-phpclan.txt"
            },
            {
              "name": "22721",
              "refsource": "OSVDB",
              "url": "http://www.osvdb.org/22721"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2006-0445",
    "datePublished": "2006-01-26T22:00:00.000Z",
    "dateReserved": "2006-01-26T00:00:00.000Z",
    "dateUpdated": "2024-08-07T16:34:14.785Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2006-0444 (GCVE-0-2006-0444)

Vulnerability from cvelistv5 – Published: 2006-01-26 22:00 – Updated: 2024-08-07 16:34
VLAI
Summary
SQL injection vulnerability in index.php in Phpclanwebsite (aka PCW) 1.23.1 allows remote attackers to execute arbitrary SQL commands via the (1) par parameter in the post function on the forum page and possibly the (2) poll_id parameter on the poll page. NOTE: the poll_id vector can also allow resultant cross-site scripting (XSS) from an unquoted error message for invalid SQL syntax.
Severity
No CVSS data available.
CWE
  • n/a
Assigner
References
URL Tags
http://www.securityfocus.com/archive/1/423145/100… mailing-listx_refsource_BUGTRAQ
http://www.securityfocus.com/bid/16391 vdb-entryx_refsource_BID
http://www.h4cky0u.org/advisories/HYSA-2006-002-p… x_refsource_MISC
http://www.osvdb.org/22722 vdb-entryx_refsource_OSVDB
http://www.osvdb.org/22720 vdb-entryx_refsource_OSVDB
http://www.vupen.com/english/advisories/2006/0342 vdb-entryx_refsource_VUPEN
http://secunia.com/advisories/18597 third-party-advisoryx_refsource_SECUNIA
https://exchange.xforce.ibmcloud.com/vulnerabilit… vdb-entryx_refsource_XF
Date Public
2006-01-26 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T16:34:14.665Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "20060125 HYSA-2006-002 Phpclanwebsite 1.23.1 Multiple Vulnerabilities",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/423145/100/0/threaded"
          },
          {
            "name": "16391",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/16391"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.h4cky0u.org/advisories/HYSA-2006-002-phpclan.txt"
          },
          {
            "name": "22722",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://www.osvdb.org/22722"
          },
          {
            "name": "22720",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://www.osvdb.org/22720"
          },
          {
            "name": "ADV-2006-0342",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2006/0342"
          },
          {
            "name": "18597",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/18597"
          },
          {
            "name": "phpclanwebsite-index-sql-injection(24355)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24355"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2006-01-26T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "SQL injection vulnerability in index.php in Phpclanwebsite (aka PCW) 1.23.1 allows remote attackers to execute arbitrary SQL commands via the (1) par parameter in the post function on the forum page and possibly the (2) poll_id parameter on the poll page.  NOTE: the poll_id vector can also allow resultant cross-site scripting (XSS) from an unquoted error message for invalid SQL syntax."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-19T14:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "20060125 HYSA-2006-002 Phpclanwebsite 1.23.1 Multiple Vulnerabilities",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/423145/100/0/threaded"
        },
        {
          "name": "16391",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/16391"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.h4cky0u.org/advisories/HYSA-2006-002-phpclan.txt"
        },
        {
          "name": "22722",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://www.osvdb.org/22722"
        },
        {
          "name": "22720",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://www.osvdb.org/22720"
        },
        {
          "name": "ADV-2006-0342",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2006/0342"
        },
        {
          "name": "18597",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/18597"
        },
        {
          "name": "phpclanwebsite-index-sql-injection(24355)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24355"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2006-0444",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "SQL injection vulnerability in index.php in Phpclanwebsite (aka PCW) 1.23.1 allows remote attackers to execute arbitrary SQL commands via the (1) par parameter in the post function on the forum page and possibly the (2) poll_id parameter on the poll page.  NOTE: the poll_id vector can also allow resultant cross-site scripting (XSS) from an unquoted error message for invalid SQL syntax."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "20060125 HYSA-2006-002 Phpclanwebsite 1.23.1 Multiple Vulnerabilities",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/423145/100/0/threaded"
            },
            {
              "name": "16391",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/16391"
            },
            {
              "name": "http://www.h4cky0u.org/advisories/HYSA-2006-002-phpclan.txt",
              "refsource": "MISC",
              "url": "http://www.h4cky0u.org/advisories/HYSA-2006-002-phpclan.txt"
            },
            {
              "name": "22722",
              "refsource": "OSVDB",
              "url": "http://www.osvdb.org/22722"
            },
            {
              "name": "22720",
              "refsource": "OSVDB",
              "url": "http://www.osvdb.org/22720"
            },
            {
              "name": "ADV-2006-0342",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2006/0342"
            },
            {
              "name": "18597",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/18597"
            },
            {
              "name": "phpclanwebsite-index-sql-injection(24355)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24355"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2006-0444",
    "datePublished": "2006-01-26T22:00:00.000Z",
    "dateReserved": "2006-01-26T00:00:00.000Z",
    "dateUpdated": "2024-08-07T16:34:14.665Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2006-0366 (GCVE-0-2006-0366)

Vulnerability from cvelistv5 – Published: 2006-01-22 20:00 – Updated: 2024-08-07 16:34
VLAI
Summary
Cross-site scripting (XSS) vulnerability in Phpclanwebsite (aka PCW) allows remote attackers to inject arbitrary web script or HTML via a javascript URI in a BBCode img tag.
Severity
No CVSS data available.
CWE
  • n/a
Assigner
References
URL Tags
http://www.securityfocus.com/archive/1/422265/100… mailing-listx_refsource_BUGTRAQ
https://archive.cert.uni-stuttgart.de/bugtraq/200… mailing-listx_refsource_BUGTRAQ
http://www.securityfocus.com/bid/16300 vdb-entryx_refsource_BID
http://secunia.com/advisories/18541 third-party-advisoryx_refsource_SECUNIA
http://www.vupen.com/english/advisories/2006/0254 vdb-entryx_refsource_VUPEN
Date Public
2006-01-17 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T16:34:14.542Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "20060117 Phpclanwebsite BBCode IMG Tag XSS Vulnerability",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/422265/100/0/threaded"
          },
          {
            "name": "20060118 Phpclanwebsite BBCode IMG Tag XSS Vulnerability",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "https://archive.cert.uni-stuttgart.de/bugtraq/2006/01/msg00343.html"
          },
          {
            "name": "16300",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/16300"
          },
          {
            "name": "18541",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/18541"
          },
          {
            "name": "ADV-2006-0254",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2006/0254"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2006-01-17T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site scripting (XSS) vulnerability in Phpclanwebsite (aka PCW) allows remote attackers to inject arbitrary web script or HTML via a javascript URI in a BBCode img tag."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-19T14:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "20060117 Phpclanwebsite BBCode IMG Tag XSS Vulnerability",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/422265/100/0/threaded"
        },
        {
          "name": "20060118 Phpclanwebsite BBCode IMG Tag XSS Vulnerability",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "https://archive.cert.uni-stuttgart.de/bugtraq/2006/01/msg00343.html"
        },
        {
          "name": "16300",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/16300"
        },
        {
          "name": "18541",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/18541"
        },
        {
          "name": "ADV-2006-0254",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2006/0254"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2006-0366",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cross-site scripting (XSS) vulnerability in Phpclanwebsite (aka PCW) allows remote attackers to inject arbitrary web script or HTML via a javascript URI in a BBCode img tag."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "20060117 Phpclanwebsite BBCode IMG Tag XSS Vulnerability",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/422265/100/0/threaded"
            },
            {
              "name": "20060118 Phpclanwebsite BBCode IMG Tag XSS Vulnerability",
              "refsource": "BUGTRAQ",
              "url": "https://archive.cert.uni-stuttgart.de/bugtraq/2006/01/msg00343.html"
            },
            {
              "name": "16300",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/16300"
            },
            {
              "name": "18541",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/18541"
            },
            {
              "name": "ADV-2006-0254",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2006/0254"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2006-0366",
    "datePublished": "2006-01-22T20:00:00.000Z",
    "dateReserved": "2006-01-22T00:00:00.000Z",
    "dateUpdated": "2024-08-07T16:34:14.542Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}