GCVE - cpe:2.3:a:exv2:content_management_system:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:exv2:content_management_system:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Exv2 (`2ed59b87-6c8a-50dc-88ff-581b8dde2a01`)
Product	Content Management System (`7cc9f6e7-5c75-597e-af11-2daf4d256759`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:sourceforge/exv2`	purl2cpe	2026-06-01 10:11:42.174234

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2007-4365`	vulnerable	2026-06-08 04:49:56.210822	Details available Cross-site scripting (XSS) vulnerability in eXV2 CMS 2.0.5 and earlier allows remote attackers to inject arbitrary web script or HTML via a set_lang cookie to an unspecified component. NOTE: this may overlap CVE-2007-1965. Published: 2007-08-15T19:00:00.000Z Updated: 2024-08-07T14:53:55.807Z Open on db.gcve.eu Reference links https://exchange.xforce.ibmcloud.com/vulnerabilities/35992 http://osvdb.org/36479 http://www.securityfocus.com/archive/1/476287/100/0/threaded http://www.i-s-o.org/security.txt http://securityreason.com/securityalert/3021	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2007-1965`	vulnerable	2026-06-08 04:49:43.896405	Details available Multiple cross-site scripting (XSS) vulnerabilities in eXV2 CMS 2.0.4.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the set_lang parameter to (1) archive.php, (2) article.php, (3) index.php, or (4) topics.php. Published: 2007-04-11T10:00:00.000Z Updated: 2024-09-16T16:23:31.043Z Open on db.gcve.eu Reference links http://marc.info/?l=bugtraq&m=117570977117962&w=2 http://www.majorsecurity.de/index_2.php?major_rls=major_rls38 http://www.securityfocus.com/bid/23314	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2006-7080`	vulnerable	2026-06-08 04:49:30.323091	Details available Directory traversal vulnerability in the avatar upload feature in exV2 2.0.4.3 and earlier allows remote attackers to delete arbitrary files via ".." sequences in the old_avatar parameter. Published: 2007-02-27T18:00:00.000Z Updated: 2024-08-07T20:50:05.952Z Open on db.gcve.eu Reference links https://www.exploit-db.com/exploits/2415 http://www.securityfocus.com/bid/20161 https://exchange.xforce.ibmcloud.com/vulnerabilities/29130	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2006-7079`	vulnerable	2026-06-08 04:49:30.322717	Details available Variable extraction vulnerability in include/common.php in exV2 2.0.4.3 and earlier allows remote attackers to overwrite arbitrary program variables and conduct directory traversal attacks to execute arbitrary code by modifying the $xoopsOption['pagetype'] variable. Published: 2007-02-27T18:00:00.000Z Updated: 2024-08-07T20:50:06.270Z Open on db.gcve.eu Reference links https://www.exploit-db.com/exploits/2415 http://www.securityfocus.com/bid/20161 https://exchange.xforce.ibmcloud.com/vulnerabilities/29116	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2006-5030`	vulnerable	2026-06-08 04:49:19.523518	Details available SQL injection vulnerability in modules/messages/index.php in exV2 2.0.4.3 and earlier allows remote authenticated users to execute arbitrary SQL commands via the sort parameter. Published: 2006-09-27T23:00:00.000Z Updated: 2024-08-07T19:32:22.888Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/20143 http://secunia.com/advisories/22045 https://www.exploit-db.com/exploits/2406 https://exchange.xforce.ibmcloud.com/vulnerabilities/29079	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.