GCVE - cpe:2.3:a:guppy:guppy:4.5.4:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:guppy:guppy:4.5.4:*:*:*:*:*:*:*

part: a version: 4.5.4 update: *

Vendor	Guppy (`46155397-8bd5-5381-9b2f-3ed754dc82d7`)
Product	Guppy (`85a1ba53-5e8f-5cb5-9bd5-86e80a87aea6`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/lernerlab/guppy`	purl2cpe	2026-06-01 10:11:12.891626

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2013-5983`	vulnerable	2026-06-08 05:04:54.988740	Details available Multiple cross-site scripting (XSS) vulnerabilities in GuppY before 4.6.28 allow remote attackers to inject arbitrary web script or HTML via the (1) "an" parameter to agenda.php or (2) cat parameter to mobile/thread.php. Published: 2014-02-06T15:00:00.000Z Updated: 2024-08-06T17:29:42.949Z Open on db.gcve.eu Reference links http://packetstormsecurity.com/files/123747 https://exchange.xforce.ibmcloud.com/vulnerabilities/88247 http://osvdb.org/98841 http://osvdb.org/98880 http://archives.neohapsis.com/archives/bugtraq/2013-10/0111.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2006-1224`	vulnerable	2026-06-08 04:48:56.575972	Details available Directory traversal vulnerability in dwnld.php in GuppY 4.5.11 allows remote attackers to overwrite arbitrary files via a "%2E." (mixed encoding) in the pg parameter. Published: 2006-03-14T11:00:00.000Z Updated: 2024-08-07T17:03:28.639Z Open on db.gcve.eu Reference links http://securityreason.com/securityalert/569 http://www.vupen.com/english/advisories/2006/0936 http://www.osvdb.org/23993 http://securitytracker.com/id?1015753 http://www.freeguppy.org/?lng=en	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2005-3927`	vulnerable	2026-06-08 04:48:42.656983	Details available Multiple directory traversal vulnerabilities in GuppY 4.5.9 and earlier allow remote attackers to read and include arbitrary files via (1) the meskin parameter to admin/editorTypetool.php, or the lng parameter to the in admin/inc scripts (2) archbatch.php, (3) dbbatch.php, and (4) nwlmail.php. Published: 2005-11-30T11:00:00.000Z Updated: 2024-08-07T23:31:48.468Z Open on db.gcve.eu Reference links http://securitytracker.com/id?1015279 https://exchange.xforce.ibmcloud.com/vulnerabilities/23319 http://www.securityfocus.com/archive/1/417899/100/0/threaded http://secunia.com/advisories/17790 http://securityreason.com/securityalert/212	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2005-3926`	vulnerable	2026-06-08 04:48:42.655943	Details available Direct static code injection vulnerability in error.php in GuppY 4.5.9 and earlier, when register_globals is disabled, allows remote attackers to execute arbitrary PHP code via the _SERVER[REMOTE_ADDR] parameter, which is injected into a .inc script that is later included by the main script. Published: 2005-11-30T11:00:00.000Z Updated: 2024-08-07T23:31:48.785Z Open on db.gcve.eu Reference links http://securitytracker.com/id?1015279 http://www.securityfocus.com/archive/1/417899/100/0/threaded http://secunia.com/advisories/17790 http://www.securityfocus.com/bid/15609 https://exchange.xforce.ibmcloud.com/vulnerabilities/23318	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Guppy

Notes

PURL mappings

Vulnerability references

Contribute