| Max CVSS | 7.5 | Min CVSS | 4.3 | Total Count | 2 |
| ID | CVSS | Summary | Last (major) update | Published | |
| CVE-2005-1881 | 7.5 |
upload.php in YaPiG 0.92b, 0.93u and 0.94u does not properly restrict the file extension for uploaded image files, which allows remote attackers to upload arbitrary files and execute arbitrary PHP code.
|
26-01-2024 - 19:07 | 06-06-2005 - 04:00 | |
| CVE-2005-1885 | 5.0 |
view.php in YaPiG 0.92b, 0.93u and 0.94u allows remote attackers to obtain sensitive information via a phid parameter that is not an integer, which reveals the path in an error message.
|
05-09-2008 - 20:50 | 06-06-2005 - 04:00 | |
| CVE-2005-1882 | 7.5 |
PHP remote file inclusion vulnerability in last_gallery.php in YaPiG 0.93u and 0.94u allows remote attackers to execute arbitrary PHP code via the YAPIG_PATH parameter.
|
05-09-2008 - 20:50 | 09-06-2005 - 04:00 | |
| CVE-2005-1883 | 5.0 |
global.php in YaPiG 0.92b allows remote attackers to include arbitrary local files via the BASE_DIR parameter.
|
05-09-2008 - 20:50 | 09-06-2005 - 04:00 | |
| CVE-2005-1884 | 6.4 |
Directory traversal vulnerability in the (1) rmdir or (2) mkdir commands in upload.php in YaPiG 0.92b, 0.93u and 0.94u allows remote attackers to create or delete arbitrary directories via a .. (dot dot) in the dir parameter.
|
05-09-2008 - 20:50 | 09-06-2005 - 04:00 | |
| CVE-2005-1886 | 4.3 |
Cross-site scripting (XSS) vulnerability in view.php in YaPiG 0.92b, 0.93u and 0.94u allows remote attackers to inject arbitrary web script or HTML via (1) the phid parameter or (2) unknown parameters when posting a new comment.
|
05-09-2008 - 20:50 | 09-06-2005 - 04:00 |