Mambo vulnerabilities, page 4
78 vulnerabilities
Known vulnerabilities in Mambo products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 67 products.
HighCVE-2006-4269joomla · x-shop_component +1 morejoomla x-shop_componentPHP remote file inclusion vulnerability in admin.x-shop.php in the x-shop component (com_x-shop) 1.7 and earlier for Mambo and Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter. NOTE: this issue has been disputed by third party researchers, stating that there is no mosConfig_absolute_path parameter and no admin.x-shop.php file in the reported packageEPSS2.80%HighCVE-2006-7202mambo · mambo_open_sourcemambo mambo_open_sourceThe dofreePDF function in includes/pdf.php in Mambo 4.6.1 does not properly check access rights for database content, which allows remote attackers to read certain content via unspecified vectors.EPSS1.41%MediumCVE-2006-7149mambomambo mamboMultiple cross-site scripting (XSS) vulnerabilities in Mambo 4.6.x allow remote attackers to inject arbitrary web script or HTML via (1) the query string to (a) index.php, which reflects the string in an error message from mod_login.php; and the (2) mcname parameter to (b) moscomment.php and (c) com_comment.php.EPSS1.16%HighCVE-2006-7104mambo · mostlycemambo mostlycePHP remote file inclusion vulnerability in htmltemplate.php in the Chad Auld MOStlyContent Editor (MOStlyCE) as created on May 2006, a component for Mambo 4.5.4, allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.EPSS2.32%HighCVE-2006-7150mambo · mambo_open_sourcemambo mambo_open_sourceMultiple SQL injection vulnerabilities in Mambo 4.6.x allow remote attackers to execute arbitrary SQL commands via the mcname parameter to (1) moscomment.php and (2) com_comment.php.EPSS1.23%HighCVE-2006-5044joomla · prince_clan_chess_component +1 morejoomla prince_clan_chess_componentUnspecified vulnerability in Prince Clan (Princeclan) Chess component (com_pcchess) 0.8 and earlier for Mambo and Joomla! has unspecified impact and attack vectors.EPSS2.00%HighCVE-2006-6634mambo · extcalthai_modulemambo extcalthai_moduleMultiple PHP remote file inclusion vulnerabilities in the ExtCalThai (com_extcalendar) 0.9.1 and earlier component for Mambo allow remote attackers to execute arbitrary PHP code via a URL in (1) the CONFIG_EXT[LANGUAGES_DIR] parameter to admin_events.php, (2) the mosConfig_absolute_path parameter to extcalendar.php, or (3) the CONFIG_EXT[LIB_DIR] parameter to lib/mail.inc.php.EPSS2.72%MediumCVE-2006-3980mambo · mambo_gallery_managermambo mambo_gallery_managerPHP remote file inclusion vulnerability in administrator/components/com_mgm/help.mgm.php in Mambo Gallery Manager (MGM) 0.95r2 and earlier for Mambo 4.5 allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.EPSS6.25%MediumCVE-2006-3947mambo · mambatstaffmambo mambatstaffPHP remote file inclusion vulnerability in components/com_mambatstaff/mambatstaff.php in the Mambatstaff 3.1b and earlier component for Mambo allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.EPSS3.11%HighCVE-2006-3263mambomambo mamboSQL injection vulnerability in the Weblinks module (weblinks.php) in Mambo 4.6rc1 and earlier allows remote attackers to execute arbitrary SQL commands via the catid parameter.EPSS1.13%HighCVE-2006-3843mambo · mambo_calendarmambo mambo_calendarPHP remote file inclusion vulnerability in com_calendar.php in Calendar Mambo Module 1.5.7 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the absolute_path parameter.EPSS2.58%MediumCVE-2006-3773mambo · smf-forummambo smf-forumPHP remote file inclusion vulnerability in smf.php in the SMF-Forum 1.3.1.3 Bridge Component (com_smf) For Joomla! and Mambo 4.5.3+ allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.EPSS5.90%HighCVE-2006-3262mambomambo mamboSQL injection vulnerability in the Weblinks module (weblinks.php) in Mambo 4.6rc1 and earlier allows remote attackers to execute arbitrary SQL commands via the title parameter.EPSS2.49%MediumCVE-2006-3749mambo · sitemapmambo sitemapPHP remote file inclusion vulnerability in sitemap.xml.php in Sitemap component (com_sitemap) 2.0.0 for Mambo 4.5.1 CMS, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.EPSS3.62%HighCVE-2006-3962mambo · bayesiannaivefiltermambo bayesiannaivefilterPHP remote file inclusion vulnerability in administrator/components/com_bayesiannaivefilter/lang.php in the bayesiannaivefilter component (com_bayesiannaivefilter) 1.1 for Mambo allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.EPSS2.21%MediumCVE-2006-3846mambo · mambo_multibannersmambo mambo_multibannersPHP remote file inclusion vulnerability in extadminmenus.class.php in the MultiBanners 1.0.1 for Mambo allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.EPSS2.91%HighCVE-2006-3981mambo · mambo_gallery_managermambo mambo_gallery_managerPHP remote file inclusion vulnerability in about.mgm.php in Mambo Gallery Manager (MGM) 0.95r2 and earlier for Mambo 4.5 allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter. NOTE: the provenance of this information is unknown; the details are obtained from third party information.EPSS1.29%HighCVE-2006-3736mambo · videodbmambo videodbPHP remote file inclusion vulnerability in core/videodb.class.xml.php in the VideoDB component for Mambo 0.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.EPSS3.29%