GCVE - cpe:2.3:a:stash:stash:1.0.3:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:stash:stash:1.0.3:*:*:*:*:*:*:*

part: a version: 1.0.3 update: *

Vendor	Stash (`bb13abf3-260c-501b-8615-a04c8a35ff2b`)
Product	Stash (`2cc3d91f-158c-546d-8405-0a16e7ffefe8`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/stashapp/stash`	purl2cpe	2026-06-01 10:14:48.328757
`pkg:golang/github.com/stashapp/stash`	purl2cpe	2026-06-01 10:14:48.328760

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2008-4590`	vulnerable	2026-06-08 04:50:46.103190	Details available Multiple SQL injection vulnerabilities in Stash 1.0.3 allow remote attackers to execute arbitrary SQL commands via (1) the username parameter to admin/login.php and (2) the post parameter to admin/news.php. Published: 2008-10-16T17:00:00.000Z Updated: 2024-08-07T10:24:19.315Z Open on db.gcve.eu Reference links http://securityreason.com/securityalert/4413 https://exchange.xforce.ibmcloud.com/vulnerabilities/45799 http://www.securityfocus.com/bid/31687 https://www.exploit-db.com/exploits/6714	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2008-4081`	vulnerable	2026-06-08 04:50:37.707234	Details available admin/login.php in Stash 1.0.3 allows remote attackers to bypass authentication and gain administrative access by setting a bsm cookie. Published: 2008-09-15T15:00:00.000Z Updated: 2024-08-07T10:00:42.501Z Open on db.gcve.eu Reference links https://exchange.xforce.ibmcloud.com/vulnerabilities/43903 https://www.exploit-db.com/exploits/6406 http://www.securityfocus.com/bid/30286 http://securityreason.com/securityalert/4258	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2008-4080`	vulnerable	2026-06-08 04:50:37.706854	Details available SQL injection vulnerability in Stash 1.0.3, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the (1) username parameter to admin/library/authenticate.php and the (2) download parameter to downloadmp3.php. NOTE: some of these details are obtained from third party information. Published: 2008-09-15T15:00:00.000Z Updated: 2024-08-07T10:00:42.511Z Open on db.gcve.eu Reference links https://exchange.xforce.ibmcloud.com/vulnerabilities/44989 http://securityreason.com/securityalert/4252 http://secunia.com/advisories/31818 https://www.exploit-db.com/exploits/6402 http://www.securityfocus.com/bid/31079	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Stash

Notes

PURL mappings

Vulnerability references

Contribute