XO
Product
Xoops
43
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 2High 1Medium 5Low 0
Watch
Add Xoops to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2017-11174 | 9.8 | Jul 12 | In install/page_dbsettings.php in the Core distribution of XOOPS 2.5.8.1, unfiltered data passed to CREATE and ALTER SQL queries caused SQL Injection in the database settings… Affected: 2.5.8.1 |
| CVE-2023-36217 | 9.0 | Aug 3 | Cross Site Scripting vulnerability in Xoops CMS v.2.5.10 allows a remote attacker to execute arbitrary code via the category name field of the image manager function Affected: 2.5.10 |
| CVE-2017-7290 | 7.2 | Mar 30 | SQL injection vulnerability in XOOPS 2.5.7.2 and other versions before 2.5.8.1 allows remote authenticated administrators to execute arbitrary SQL commands via the url parameter… Affected: 2.5.7.2; 2.5.7.3; 2.5.8.1 |
| CVE-2017-12139 | 6.1 | Aug 2 | XOOPS Core 2.5.8 has stored XSS in imagemanager.php because of missing MIME type validation in htdocs/class/uploader.php Affected: 2.5.8 |
| CVE-2017-12138 | 6.1 | Aug 2 | XOOPS Core 2.5.8 has a stored URL redirect bypass vulnerability in /modules/profile/index.php because of the URL filter Affected: 2.5.8 |
| CVE-2017-7944 | 6.1 | Apr 24 | XOOPS Core 2.5.8.1 has XSS due to unescaped HTML output of an Install DB failure error message in page_dbsettings.php Affected: 2.5.8.1 |
| CVE-2019-16684 | 4.8 | Sep 30 | An issue was discovered in the image-manager in Xoops 2.5.10 Affected: 2.5.10 |
| CVE-2019-16683 | 4.8 | Sep 30 | An issue was discovered in the image-manager in Xoops 2.5.10 Affected: 2.5.10 |
| CVE-2014-8999 | – | Nov 20 | SQL injection vulnerability in htdocs/modules/system/admin.php in XOOPS before 2.5.7 Final allows remote authenticated users to execute arbitrary SQL commands via the selgroups… Affected: through 2.5.6 |
| CVE-2012-0984 | – | Sep 11 | Multiple cross-site scripting (XSS) vulnerabilities in XOOPS before 2.5.5 allow remote attackers to inject arbitrary web script or HTML via the (1) to_userid parameter to… Affected: through 2.5.4; 2.5.0; 2.5.1; 2.5.2; 2.5.2; 2.5.3 |
| CVE-2011-4565 | – | Nov 28 | Multiple cross-site scripting (XSS) vulnerabilities in XOOPS 2.5.1.a, and possibly earlier versions, allow remote attackers to inject arbitrary web script or HTML via the (1) text… Affected: through 2.5.1.a; 2.0.2; 2.0.13.2; 2.0.14; 2.0.14; 2.0.15; +24 more |
| CVE-2011-3822 | – | Sep 24 | XOOPS 2.5.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated… Affected: 2.5.0 |
| CVE-2009-4851 | – | May 7 | The activation resend function in the Profiles module in XOOPS before 2.4.1 sends activation codes in response to arbitrary activation requests, which allows remote attackers to… Affected: through 2.4.0; 1.0; 1.0_rc1; 1.0_rc3; 1.0_rc3.0.5; 1.3.5; +34 more |
| CVE-2009-3963 | – | Nov 17 | Multiple unspecified vulnerabilities in XOOPS before 2.4.0 Final have unknown impact and attack vectors Affected: through 2.3.3; 2.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; +23 more |
| CVE-2009-2783 | – | Aug 17 | Multiple cross-site scripting (XSS) vulnerabilities in XOOPS 2.3.3 allow remote attackers to inject arbitrary web script or HTML via the (1) op parameter to… Affected: 2.3.3 |
| CVE-2008-6885 | – | Jul 31 | Cross-site scripting (XSS) vulnerability in pmlite.php in XOOPS 2.3.1 and 2.3.2a allows remote attackers to inject arbitrary web script or HTML via a STYLE attribute in a URL… Affected: 2.3.1; 2.3.2a |
| CVE-2008-6884 | – | Jul 31 | Multiple directory traversal vulnerabilities in XOOPS 2.3.1, when register_globals is enabled, allow remote attackers to include and execute arbitrary local files via a Affected: 2.3.1 |
| CVE-2008-5665 | – | Dec 19 | SQL injection vulnerability in index.php in the xhresim module in XOOPS allows remote attackers to execute arbitrary SQL commands via the no parameter Affected: All versions, or not specified |
| CVE-2008-3296 | – | Jul 25 | Directory traversal vulnerability in modules/system/admin.php in XOOPS 2.0.18 1 allows remote attackers to include and execute arbitrary local files via a Affected: 2.0.18.1 |
| CVE-2008-3295 | – | Jul 25 | Cross-site scripting (XSS) vulnerability in modules/system/admin.php in XOOPS 2.0.18.1 allows remote attackers to inject arbitrary web script or HTML via the fct parameter Affected: 2.0.18.1 |
| CVE-2008-2035 | – | Apr 30 | Cross-site scripting (XSS) vulnerability in the Bluemoon, Inc Affected: 2.0 |
| CVE-2008-0613 | – | Feb 6 | Open redirect vulnerability in htdocs/user.php in XOOPS 2.0.18 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the… Affected: 2.0.18 |
| CVE-2008-0611 | – | Feb 6 | SQL injection vulnerability in rmgs/images.php in the RMSOFT Gallery System 2.0 module for XOOPS allows remote attackers to execute arbitrary SQL commands via the id parameter Affected: All versions, or not specified |
| CVE-2008-0612 | – | Feb 6 | Directory traversal vulnerability in htdocs/install/index.php in XOOPS 2.0.18 allows remote attackers to include and execute arbitrary local files via a Affected: 2.0.18 |
| CVE-2007-6675 | – | Jan 8 | The b_system_comments_show function in htdocs/modules/system/blocks/system_blocks.php in XOOPS before 2.0.18 does not check permissions, which allows remote attackers to read the… Affected: through 2.0.17_1 |
| CVE-2007-5188 | – | Oct 3 | Unspecified vulnerability in the XOOPS uploader class in Xoops 2.0.17.1-RC1 and earlier allows remote attackers to upload arbitrary files via unspecified vectors related to… Affected: through 2.0.17.1-rc1 |
| CVE-2007-0377 | – | Jan 19 | Multiple SQL injection vulnerabilities in Xoops 2.0.16 allow remote attackers to execute arbitrary SQL commands via (1) the id parameter in kernel/group.php in core, (2) the lid… Affected: 2.0.16 |
| CVE-2006-5810 | – | Nov 8 | Cross-site scripting (XSS) vulnerability in modules/wfdownloads/newlist.php in XOOPS 1.0 allows remote attackers to inject arbitrary web script or HTML via the newdownloadshowdays… Affected: 1.0 |
| CVE-2006-4417 | – | Aug 28 | SQL injection vulnerability in edituser.php in Xoops before 2.0.15 allows remote attackers to execute arbitrary SQL commands via the user_avatar parameter Affected: through 2.0.14 |
| CVE-2006-2516 | – | May 22 | mainfile.php in XOOPS 2.0.13.2 and earlier, when register_globals is enabled, allows remote attackers to overwrite variables such as $xoopsOption['nocommon'] and conduct directory… Affected: through 2.0.13.2; 2.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; +12 more |
| CVE-2005-3680 | – | Nov 18 | Directory traversal vulnerability in editor_registry.php in XOOPS 2.2.3 allows remote attackers to read or include arbitrary local files via a Affected: 2.2.3 |
| CVE-2005-2338 | – | Oct 27 | Multiple cross-site scripting (XSS) vulnerabilities in XOOPS 2.0.12 JP and earlier, XOOPS 2.0.13.1 and earlier, and 2.2.x up to 2.2.3 RC1 allow remote attackers to inject… Affected: through 2.0.12_jp; through 2.0.13.1; through 2.2.3_rc1 |
| CVE-2005-2113 | – | Jul 5 | SQL injection vulnerability in the loginUser function in the XMLRPC server in XOOPS 2.0.11 and earlier allows remote attackers to execute arbitrary SQL commands and bypass… Affected: 2.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; +9 more |
| CVE-2005-2112 | – | Jul 5 | Multiple cross-site scripting (XSS) vulnerabilities in XOOPS 2.0.11 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) order parameter to… Affected: 2.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; +9 more |
| CVE-2005-0743 | – | May 2 | The custom avatar uploading feature (uploader.php) for XOOPS 2.0.9.2 and earlier allows remote attackers to upload arbitrary PHP scripts, whose file extensions are not filtered Affected: 1.0_rc1; 1.0_rc3; 1.0_rc3.0.5; 1.3.5; 1.3.6; 1.3.7; +11 more |
| CVE-2004-2756 | – | Dec 31 | Cross-site scripting (XSS) vulnerability in viewtopic.php in Xoops 2.x, possibly 2 through 2.0.5, allows remote attackers to inject arbitrary web script or HTML via the (1) forum… Affected: 2.0; 2.0.1; 2.0.2; 2.0.3; 2.0.5; 2.0.5.1; +1 more |
| CVE-2003-1550 | – | Dec 31 | XOOPS 2.0, and possibly earlier versions, allows remote attackers to obtain sensitive information via an invalid xoopsOption parameter, which reveals the installation path in an… Affected: through 2.0 |
| CVE-2003-1453 | – | Dec 31 | Cross-site scripting (XSS) vulnerability in the MytextSanitizer function in XOOPS 1.3.5 through 1.3.9 and XOOPS 2.0 through 2.0.1 allows remote attackers to inject arbitrary web… Affected: 1.3.5; 1.3.6; 1.3.7; 1.3.8; 1.3.9; 2.0; +1 more |
| CVE-2002-2386 | – | Dec 31 | Cross-site scripting (XSS) vulnerability in the Quizz module for XOOPS 1.0, when allowing on-line question development, allows remote attackers to inject arbitrary web script or… Affected: 1.0_rc3 |
| CVE-2002-2391 | – | Dec 31 | SQL injection vulnerability in index.php of WebChat 1.5 included in XOOPS 1.0 allows remote attackers to execute arbitrary SQL commands via the roomid parameter Affected: 1.0 |
| CVE-2002-1802 | – | Dec 31 | Cross-site scripting (XSS) vulnerability in Xoops 1.0 RC3 allows remote attackers to inject arbitrary web script or HTML via Javascript in an IMG tag when submitting news Affected: 1.0_rc3 |
| CVE-2002-0217 | – | May 16 | Cross-site scripting (CSS) vulnerabilities in the Private Message System for XOOPS 1.0 RC1 allow remote attackers to execute Javascript on other web clients via (1) the Title… Affected: 1.0_rc1 |
| CVE-2002-0216 | – | May 16 | userinfo.php in XOOPS 1.0 RC1 allows remote attackers to obtain sensitive information via a SQL injection attack in the "uid" parameter Affected: 1.0_rc1 |
Showing 43