GCVE - cpe:2.3:a:bitweaver:bitweaver:2.5:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:bitweaver:bitweaver:2.5:*:*:*:*:*:*:*

part: a version: 2.5 update: *

Vendor	Bitweaver (`2b3bd549-db21-57bc-8d5d-0b82e0e027ff`)
Product	Bitweaver (`59f0d89f-fea5-5624-8e0d-f1972574a321`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/bitweavercms/bitweaver`	purl2cpe	2026-06-01 10:11:28.553724
`pkg:sourceforge/bitweaver`	purl2cpe	2026-06-01 10:11:28.553726

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2012-5192`	vulnerable	2026-06-08 05:02:55.154958	Details available Directory traversal vulnerability in gmap/view_overlay.php in Bitweaver 2.8.1 and earlier allows remote attackers to read arbitrary files via "''%2F" (dot dot encoded slash) sequences in the overlay_type parameter. Published: 2014-01-28T00:00:00.000Z Updated: 2024-08-06T20:58:03.251Z Open on db.gcve.eu Reference links https://www.trustwave.com/spiderlabs/advisories/TWSL2012-016.txt	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2009-1678`	vulnerable	2026-06-08 04:51:24.367879	Details available Directory traversal vulnerability in the saveFeed function in rss/feedcreator.class.php in Bitweaver 2.6 and earlier allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) in the version parameter to boards/boards_rss.php. Published: 2009-05-18T18:00:00.000Z Updated: 2024-08-07T05:20:35.179Z Open on db.gcve.eu Reference links http://secunia.com/advisories/35057 http://www.securityfocus.com/bid/34910 http://www.securityfocus.com/archive/1/503435 https://www.exploit-db.com/exploits/8659	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2009-1677`	vulnerable	2026-06-08 04:51:24.367264	Details available Multiple static code injection vulnerabilities in the saveFeed function in rss/feedcreator.class.php in Bitweaver 2.6 and earlier allow (1) remote authenticated users to inject arbitrary PHP code into files by placing PHP sequences into the account's "display name" setting and then invoking boards/boards_rss.php, and might allow (2) remote attackers to inject arbitrary PHP code into files via the HTTP Host header in a request to boards/boards_rss.php. Published: 2009-05-18T18:00:00.000Z Updated: 2024-08-07T05:20:35.195Z Open on db.gcve.eu Reference links http://secunia.com/advisories/35057 http://www.securityfocus.com/bid/34910 http://www.securityfocus.com/archive/1/503435 https://www.exploit-db.com/exploits/8659 https://exchange.xforce.ibmcloud.com/vulnerabilities/50631	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.