GCVE - cpe:2.3:a:bitweaver:bitweaver:2.0.2:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:bitweaver:bitweaver:2.0.2:*:*:*:*:*:*:*

part: a version: 2.0.2 update: *

Vendor	Bitweaver (`2b3bd549-db21-57bc-8d5d-0b82e0e027ff`)
Product	Bitweaver (`59f0d89f-fea5-5624-8e0d-f1972574a321`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/bitweavercms/bitweaver`	purl2cpe	2026-06-01 10:11:28.552568
`pkg:sourceforge/bitweaver`	purl2cpe	2026-06-01 10:11:28.552569

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2012-5192`	vulnerable	2026-06-08 05:02:55.153207	Details available Directory traversal vulnerability in gmap/view_overlay.php in Bitweaver 2.8.1 and earlier allows remote attackers to read arbitrary files via "''%2F" (dot dot encoded slash) sequences in the overlay_type parameter. Published: 2014-01-28T00:00:00.000Z Updated: 2024-08-06T20:58:03.251Z Open on db.gcve.eu Reference links https://www.trustwave.com/spiderlabs/advisories/TWSL2012-016.txt	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2009-1678`	vulnerable	2026-06-08 04:51:24.367860	Details available Directory traversal vulnerability in the saveFeed function in rss/feedcreator.class.php in Bitweaver 2.6 and earlier allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) in the version parameter to boards/boards_rss.php. Published: 2009-05-18T18:00:00.000Z Updated: 2024-08-07T05:20:35.179Z Open on db.gcve.eu Reference links http://secunia.com/advisories/35057 http://www.securityfocus.com/bid/34910 http://www.securityfocus.com/archive/1/503435 https://www.exploit-db.com/exploits/8659	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2009-1677`	vulnerable	2026-06-08 04:51:24.365840	Details available Multiple static code injection vulnerabilities in the saveFeed function in rss/feedcreator.class.php in Bitweaver 2.6 and earlier allow (1) remote authenticated users to inject arbitrary PHP code into files by placing PHP sequences into the account's "display name" setting and then invoking boards/boards_rss.php, and might allow (2) remote attackers to inject arbitrary PHP code into files via the HTTP Host header in a request to boards/boards_rss.php. Published: 2009-05-18T18:00:00.000Z Updated: 2024-08-07T05:20:35.195Z Open on db.gcve.eu Reference links http://secunia.com/advisories/35057 http://www.securityfocus.com/bid/34910 http://www.securityfocus.com/archive/1/503435 https://www.exploit-db.com/exploits/8659 https://exchange.xforce.ibmcloud.com/vulnerabilities/50631	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2008-4337`	vulnerable	2026-06-08 04:50:38.676471	Details available Cross-site scripting (XSS) vulnerability in Bitweaver 2.0.2 allows remote attackers to inject arbitrary web script or HTML via the URL parameter to (1) edit.php and (2) list.php in articles/; (3) list_blogs.php and (4) rankings.php in blogs/; (5) calendar/index.php; (6) calendar.php, (7) index.php, and (8) list_events.php in events/; (9) index.php and (10) list_galleries.php in fisheye/; (11) liberty/list_content.php; (12) newsletters/edition.php; (13) pigeonholes/list.php; (14) recommends/index.php; (15) rss/index.php; (16) stars/index.php; (17) users/remind_password.php; (18) wiki/orphan_pages.php; and (19) stats/index.php, different vectors than CVE-2007-0526 and CVE-2005-4379. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Published: 2008-09-30T17:00:00.000Z Updated: 2024-08-07T10:08:35.153Z Open on db.gcve.eu Reference links http://secunia.com/advisories/32014 http://www.securityfocus.com/bid/31395 https://exchange.xforce.ibmcloud.com/vulnerabilities/45409	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.