GCVE - cpe:2.3:a:opendocman:opendocman:1.2.5:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:opendocman:opendocman:1.2.5:*:*:*:*:*:*:*

part: a version: 1.2.5 update: *

Vendor	Opendocman (`450294d2-97a7-5db5-b3fd-359509c9e488`)
Product	Opendocman (`6932637b-1f59-543e-a8a3-0f4f38e16346`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/opendocman/opendocman`	purl2cpe	2026-06-01 10:11:16.179930
`pkg:sourceforge/opendocman`	purl2cpe	2026-06-01 10:11:16.179933

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2009-3801`	vulnerable	2026-06-08 04:51:44.284790	Details available SQL injection vulnerability in index.php in OpenDocMan 1.2.5 allows remote attackers to execute arbitrary SQL commands via the frmpass (aka Password) parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Published: 2009-10-27T16:00:00.000Z Updated: 2024-09-17T01:05:29.360Z Open on db.gcve.eu Reference links http://secunia.com/advisories/30750	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2009-3789`	vulnerable	2026-06-08 04:51:44.203582	Details available Multiple cross-site scripting (XSS) vulnerabilities in OpenDocMan 1.2.5 allow remote attackers to inject arbitrary web script or HTML via the last_message parameter to (1) add.php, (2) toBePublished.php, (3) index.php, and (4) admin.php; the PATH_INFO to the default URI to (5) category.php, (6) department.php, (7) profile.php, (8) rejects.php, (9) search.php, (10) toBePublished.php, (11) user.php, and (12) view_file.php; and (13) the caller parameter in a Modify User action to user.php. Published: 2009-10-26T17:00:00.000Z Updated: 2024-08-07T06:38:30.399Z Open on db.gcve.eu Reference links http://osvdb.org/59302 http://osvdb.org/59307 http://www.securityfocus.com/bid/36777 http://osvdb.org/59309 http://osvdb.org/59304	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2009-3788`	vulnerable	2026-06-08 04:51:44.202743	Details available SQL injection vulnerability in index.php in OpenDocMan 1.2.5 allows remote attackers to execute arbitrary SQL commands via the frmuser (aka Username) parameter. Published: 2009-10-26T17:00:00.000Z Updated: 2024-08-07T06:38:30.376Z Open on db.gcve.eu Reference links http://osvdb.org/59301 http://www.securityfocus.com/bid/36777 https://exchange.xforce.ibmcloud.com/vulnerabilities/53886 http://secunia.com/advisories/30750 http://www.packetstormsecurity.org/0910-exploits/opendocman-sqlxss.txt	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2008-2788`	vulnerable	2026-06-08 04:50:32.149610	Details available Cross-site scripting (XSS) vulnerability in index.php in OpenDocMan 1.2.5 allows remote attackers to inject arbitrary web script or HTML via the redirection parameter. Published: 2008-06-20T10:00:00.000Z Updated: 2024-09-17T01:06:38.933Z Open on db.gcve.eu Reference links http://sourceforge.net/tracker/index.php?func=detail&aid=1975163&group_id=69505&atid=524753 http://secunia.com/advisories/30750	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2008-2787`	vulnerable	2026-06-08 04:50:32.149235	Details available Cross-site scripting (XSS) vulnerability in out.php in OpenDocMan 1.2.5 allows remote attackers to inject arbitrary web script or HTML via the last_message parameter. Published: 2008-06-20T10:00:00.000Z Updated: 2024-08-07T09:14:14.736Z Open on db.gcve.eu Reference links http://securityreason.com/securityalert/3948 https://exchange.xforce.ibmcloud.com/vulnerabilities/43135 http://secunia.com/advisories/30750 http://www.securityfocus.com/bid/29765 http://www.s21sec.com/avisos/s21sec-044-en.txt	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Opendocman

Notes

PURL mappings

Vulnerability references

Contribute