Mambo vulnerabilities
78 vulnerabilities
Known vulnerabilities in Mambo products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 67 products.
Products
50 of 67- Mambo20 vulnerabilities
- Mambo Open Source6 vulnerabilities
- Mambo Site Server6 vulnerabilities
- Mambo Calendar2 vulnerabilities
- Mambo Gallery Manager2 vulnerabilities
- Mambo Open Source 4.52 vulnerabilities
- Mostlyce2 vulnerabilities
- A6Mambocredits Component1 vulnerabilities
- Bayesiannaivefilter1 vulnerabilities
- Catalogshop Component1 vulnerabilities
- CMS1 vulnerabilities
- Com Awesom1 vulnerabilities
- Com Comments1 vulnerabilities
- Com Comprofiler Component1 vulnerabilities
- Com Ewriting1 vulnerabilities
- Com Facileforms1 vulnerabilities
- Com Flippingbook1 vulnerabilities
- Com Garyscookbook1 vulnerabilities
- Com Jokes1 vulnerabilities
- Com Neogallery1 vulnerabilities
- Com Neoreferences1 vulnerabilities
- Com Quiz1 vulnerabilities
- Com Recipes1 vulnerabilities
- Com Ricette Component1 vulnerabilities
- Com Sermon1 vulnerabilities
- Datsogallery1 vulnerabilities
- Extcalthai Module1 vulnerabilities
- Flatmenu1 vulnerabilities
- Glossary1 vulnerabilities
- Jambook1 vulnerabilities
- Kemas Antonius Com Quran1 vulnerabilities
- Mambatstaff1 vulnerabilities
- Mambelfish Component1 vulnerabilities
- Mambo CMS1 vulnerabilities
- Mambo Multibanners1 vulnerabilities
- Mambo Portal1 vulnerabilities
- Nfn Address Book1 vulnerabilities
- Prince Clan Chess Component1 vulnerabilities
- Site Server1 vulnerabilities
- Sitemap1 vulnerabilities
- Smf Forum1 vulnerabilities
- Swmenu Component1 vulnerabilities
- Taskhopper Component1 vulnerabilities
- Videodb1 vulnerabilities
- X Shop Component1 vulnerabilities
- Anjel Component0 vulnerabilities
- Artlinks Component0 vulnerabilities
- Bigape Backup Component0 vulnerabilities
- Com Comprofiler0 vulnerabilities
- Com Detail0 vulnerabilities
CVE-2003-1203mambomambo_site_server
EPSS score3.57%
Cross-site scripting (XSS) vulnerability in index.php for Mambo Site Server 4.0.10 allows remote attackers to execute script on other clients via the ?option parameter.CVE-2013-2565mambo-foundationmambo_cms+1EPSS score1.60%
A vulnerability in Mambo CMS v4.6.5 where the scripts thumbs.php, editorFrame.php, editor.php, images.php, manager.php discloses the root path of the webserver.CVE-2007-2005joomlataskhopper_component+1EPSS score6.68%
Multiple PHP remote file inclusion vulnerabilities in the Taskhopper 1.1 component for Mambo and Joomla! allow remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter to (1) contact_type.php, (2) itemstatus_type.php, (3) projectstatus_type.php, (4) request_type.php, (5) responses_type.php, (6) timelog_type.php, or (7) urgency_type.php in inc/.CVE-2007-2049mambomambo_calendarEPSS score2.32%
Multiple PHP remote file inclusion vulnerabilities in the Calendar Module (com_calendar) 1.5.5 for Mambo allow remote attackers to execute arbitrary PHP code via a URL in the absolute_path parameter to (1) com_calendar.php or (2) mod_calendar.php.CVE-2007-2557mambomamboEPSS score0.85%
MOStlyDB Admin in Mambo 4.6.1 does not properly check privileges, which allows remote authenticated administrators to have an unknown impact via unspecified vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.CVE-2007-2196joomlajambook+1EPSS score1.73%
PHP remote file inclusion vulnerability in jambook.php in the Jambook (com_Jambook) 1.0 beta7 module for Mambo and Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter. NOTE: this issue has been disputed by a reliable third party because the jambook.php protects against direct requestCVE-2007-1702mamboflatmenuEPSS score4.96%
PHP remote file inclusion vulnerability in mod_flatmenu.php in the Flatmenu 1.07 and earlier Mambo module allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.CVE-2007-1699joomlaswmenu_component+1EPSS score10.57%
Multiple PHP remote file inclusion vulnerabilities in the SWmenu (com_swmenupro and com_swmenufree) 4.0 component for Mambo and Joomla! allow remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter to ImageManager/Classes/ImageManager.php under the (1) components/ or (2) administrator/components/ directory trees.CVE-2007-1596joomlanfn_address_book+1EPSS score7.90%
Multiple PHP remote file inclusion vulnerabilities in the NFN Address Book (com_nfn_addressbook) 0.4 component for Mambo and Joomla! allow remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter to (1) components/com_nfn_addressbook/nfnaddressbook.php or (2) administrator/components/com_nfn_addressbook/nfnaddressbook.php.CVE-2007-0374joomlajoomla\!+1EPSS score1.28%
SQL injection vulnerability in (1) Joomla! 1.0.11 and 1.5 Beta, and (2) Mambo 4.6.1, allows remote attackers to execute arbitrary SQL commands via the id parameter when cancelling content editing.CVE-2007-0789mambomamboEPSS score1.05%
SQL injection vulnerability in Mambo before 4.5.5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors in cancel edit functions, possibly related to the id parameter.CVE-2007-4203mambomambo_open_sourceEPSS score1.93%
Session fixation vulnerability in Mambo 4.6.2 CMS allows remote attackers to hijack web sessions by setting the Cookie parameter.CVE-2007-6455mambomamboEPSS score1.50%
Multiple cross-site scripting (XSS) vulnerabilities in index.php in Mambo 4.6.2 allow remote attackers to inject arbitrary web script or HTML via the (1) Itemid parameter in a com_frontpage option and the (2) option parameter.CVE-2001-1011mambomambo_site_serverEPSS score4.42%
index2.php in Mambo Site Server 3.0.0 through 3.0.5 allows remote attackers to gain Mambo administrator privileges by setting the PHPSESSID parameter and providing the appropriate administrator information in other parameters.CVE-2005-2002mambomamboEPSS score1.32%
SQL injection vulnerability in content.php in Mambo 4.5.2.2 and earlier allows remote attackers to execute arbitrary SQL commands via the user_rating parameter.CVE-2005-0512mambomamboEPSS score1.28%
PHP remote file inclusion vulnerability in Tar.php in Mambo 4.5.2 allows remote attackers to execute arbitrary PHP code by modifying the mosConfig_absolute_path parameter to reference a URL on a remote web server that contains the code, a different vulnerability than CVE-2004-1693.CVE-2005-4156mambomambo_open_source_4.5EPSS score1.78%
Unspecified vulnerability in Mambo 4.5 (1.0.0) through 4.5 (1.0.9), with magic_quotes_gpc disabled, allows remote attackers to read arbitrary files and possibly cause a denial of service via a query string that ends with a NULL character.CVE-2005-3586mambomamboEPSS score1.31%
content.php in Mambo 4.5.2 through 4.5.2.3 allows remote attackers to obtain the installation path of the application via a URL that causes the application to return an error.CVE-2005-3738mambomambo_site_serverEPSS score4.88%
globals.php in Mambo Site Server 4.0.14 and earlier, when register_globals is disabled, allows remote attackers to overwrite variables in the GLOBALS array and conduct various attacks, as demonstrated using the mosConfig_absolute_path parameter to content.html.php for remote PHP file inclusion.CVE-2008-2990joomlacom_facileforms+1EPSS score2.29%
PHP remote file inclusion vulnerability in facileforms.frame.php in the FacileForms (com_facileforms) component 1.4.4 for Mambo and Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the ff_compath parameter.