Sourceforge vulnerabilities
28 vulnerabilities
Known vulnerabilities in Sourceforge products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 26 products.
Products
26- 202Cms2 vulnerabilities
- Data Center Audit2 vulnerabilities
- Easyndexer2 vulnerabilities
- Creammonkey1 vulnerabilities
- Echo Mirage1 vulnerabilities
- Emule X Ray1 vulnerabilities
- GPS Tracking System1 vulnerabilities
- Greasekit1 vulnerabilities
- Jgbbs1 vulnerabilities
- Meneame English Pligg1 vulnerabilities
- Mymarket1 vulnerabilities
- Net Snmp1 vulnerabilities
- Newsdaemon1 vulnerabilities
- Openbiz Cubi Lite1 vulnerabilities
- Php Ticket1 vulnerabilities
- Phpfilemanager1 vulnerabilities
- Phpmyclub1 vulnerabilities
- Placeto CMS1 vulnerabilities
- Putmail1 vulnerabilities
- Simplepress CMS1 vulnerabilities
- Snes9K 0.0.9Z1 vulnerabilities
- Sox Sound Exchange1 vulnerabilities
- Web Slider1 vulnerabilities
- Webmplayer1 vulnerabilities
- Wordperfect Document Importer Exporter1 vulnerabilities
- Wow Raid Manager1 vulnerabilities
CVE-2018-25166sourceforgemeneame english pligg
EPSS score0.24%
Meneame English Pligg 5.8 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the search parameter. Attackers can send GET requests to index.php with crafted SQL payloads in the search parameter to extract sensitive database information including usernames, database names, and version details.CVE-2018-25209sourceforgeopenbiz cubi liteEPSS score0.33%
OpenBiz Cubi Lite 3.0.8 contains a SQL injection vulnerability in the login form that allows unauthenticated attackers to manipulate database queries through the username parameter. Attackers can submit POST requests to /bin/controller.php with malicious SQL code in the username field to extract sensitive database information or bypass authentication.CVE-2018-25177sourceforgedata center auditEPSS score0.13%
Data Center Audit 2.6.2 contains a cross-site request forgery vulnerability that allows attackers to reset administrator passwords without authentication by submitting crafted POST requests. Attackers can send requests to dca_resetpw.php with parameters updateuser, pass, pass2, and submit_reset to change the admin account password and gain administrative access.CVE-2018-25178rul10easyndexer+1EPSS score0.59%
Easyndexer 1.0 contains an arbitrary file download vulnerability that allows unauthenticated attackers to download sensitive files by manipulating the file parameter. Attackers can send POST requests to showtif.php with arbitrary file paths in the file parameter to retrieve system files like configuration and initialization files.CVE-2018-25192sourceforgegps tracking systemEPSS score0.29%
GPS Tracking System 2.12 contains an SQL injection vulnerability that allows unauthenticated attackers to bypass authentication by injecting SQL code through the username parameter. Attackers can submit crafted POST requests to the login.php endpoint with SQL injection payloads in the username field to gain unauthorized access without valid credentials.CVE-2018-25251sourceforgesnes9k 0.0.9zEPSS score0.18%
Snes9K 0.0.9z contains a buffer overflow vulnerability in the Netplay Socket Port Number field that allows local attackers to trigger a structured exception handler (SEH) overwrite. Attackers can craft a malicious payload and paste it into the Socket Port Number field via the Netplay Options menu to achieve code execution through SEH chain exploitation.CVE-2018-25189sourceforgedata center auditEPSS score0.24%
Data Center Audit 2.6.2 contains an SQL injection vulnerability in the username parameter of dca_login.php that allows unauthenticated attackers to execute arbitrary SQL queries. Attackers can submit crafted SQL payloads through POST requests to extract sensitive database information including usernames, database names, and version details.CVE-2018-25190rul10easyndexer+1EPSS score0.13%
Easyndexer 1.0 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to create administrative accounts by submitting forged POST requests. Attackers can craft malicious web pages that submit POST requests to createuser.php with parameters including username, password, name, surname, and privileges set to 1 for administrator access.CVE-2007-1572sourceforgejgbbsEPSS score0.88%
SQL injection vulnerability in search.asp in JGBBS 3.0 Beta 1 and earlier allows remote attackers to execute arbitrary SQL commands via the title parameter, a different vector than CVE-2007-1440. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.CVE-2007-1466debianlibwpd+1EPSS score3.39%
Integer overflow in the WP6GeneralTextPacket::_readContents function in WordPerfect Document importer/exporter (libwpd) before 0.8.9 allows user-assisted remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted WordPerfect file, a different vulnerability than CVE-2007-0002.CVE-2007-1137sourceforgeputmailEPSS score0.92%
putmail.py in Putmail before 1.4 does not detect when a user attempts to use TLS with a server that does not support it, which causes putmail.py to send the username and password in plaintext while the user believes encryption is in use, and allows remote attackers to obtain sensitive information.CVE-2007-1135sourceforgewebmplayerEPSS score1.08%
Multiple SQL injection vulnerabilities in WebMplayer before 0.6.1-Alpha allow remote attackers to execute arbitrary SQL commands via the (1) strid parameter to index.php and the (2) id[0] or other id array index parameter to filecheck.php.CVE-2007-6640sourceforgecreammonkey+1EPSS score1.19%
Creammonkey 0.9 through 1.1 and GreaseKit 1.2 through 1.3 does not properly prevent access to dangerous functions, which allows remote attackers to read the configuration, modify the configuration, or send an HTTP request via the (1) GM_addStyle, (2) GM_log, (3) GM_openInTab, (4) GM_setValue, (5) GM_getValue, or (6) GM_xmlhttpRequest function within a web page on which a userscript is configured.CVE-2001-0234sourceforgenewsdaemonEPSS score1.77%
NewsDaemon before 0.21b allows remote attackers to execute arbitrary SQL queries and gain privileges via a malformed user_username parameter.CVE-2005-4837debiannet-snmp+2EPSS score9.74%
snmp_api.c in snmpd in Net-SNMP 5.2.x before 5.2.2, 5.1.x before 5.1.3, and 5.0.x before 5.0.10.2, when running in master agentx mode, allows remote attackers to cause a denial of service (crash) by causing a particular TCP disconnect, which triggers a free of an incorrect variable, a different vulnerability than CVE-2005-2177.CVE-2008-2503sourceforgeemule_x-rayEPSS score1.43%
Buffer overflow in Uploadlist in eMule X-Ray before 1.4 has unknown impact and remote attack vectors.CVE-2008-2298sourceforgeweb_sliderEPSS score2.79%
Admin.php in Web Slider 0.6 allows remote attackers to bypass authentication and gain privileges by setting the admin cookie to 1.CVE-2008-0501sourceforgephpmyclubEPSS score1.85%
Directory traversal vulnerability in phpMyClub 0.0.1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the page_courante parameter to the top-level URI.CVE-2008-6161sourceforgewow_raid_managerEPSS score1.02%
Cross-site scripting (XSS) vulnerability in WOW Raid Manager (WRM) before 3.5.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.CVE-2002-2362sourceforgemymarketEPSS score1.60%
Cross-site scripting (XSS) vulnerability in form_header.php in MyMarket 1.71 allows remote attackers to inject arbitrary web script or HTML via the noticemsg parameter.