GCVE - cpe:2.3:a:phpwebthings:phpwebthings:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:phpwebthings:phpwebthings:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Phpwebthings (`c300586d-02ad-593f-9bf0-51407eeaacf5`)
Product	Phpwebthings (`d54d5412-56d3-5c1b-a3e5-ef0b54638e4c`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:sourceforge/phpwebthings`	purl2cpe	2026-06-01 10:18:07.531509

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2009-2147`	vulnerable	2026-06-08 04:51:26.992837	Details available SQL injection vulnerability in fdown.php in phpWebThings 1.5.2 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter. Published: 2009-06-22T14:00:00.000Z Updated: 2024-08-07T05:36:21.061Z Open on db.gcve.eu Reference links http://secunia.com/advisories/35396 https://www.exploit-db.com/exploits/8939 http://www.securityfocus.com/bid/35336 https://exchange.xforce.ibmcloud.com/vulnerabilities/51094	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2009-2081`	vulnerable	2026-06-08 04:51:26.660756	Details available Directory traversal vulnerability in help.php in phpWebThings 1.5.2 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the module parameter. Published: 2009-06-16T19:00:00.000Z Updated: 2024-08-07T05:36:20.964Z Open on db.gcve.eu Reference links https://www.exploit-db.com/exploits/8928 http://www.securityfocus.com/bid/35313	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2006-6042`	vulnerable	2026-06-08 04:49:21.845959	Details available PHP remote file inclusion vulnerability in core/editor.php in phpWebThings 1.5.2 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the editor_insert_bottom parameter. Published: 2006-11-22T00:00:00.000Z Updated: 2024-08-07T20:12:31.342Z Open on db.gcve.eu Reference links https://www.exploit-db.com/exploits/2811 http://www.securityfocus.com/archive/1/470794/100/0/threaded https://exchange.xforce.ibmcloud.com/vulnerabilities/30401 http://www.securityfocus.com/bid/21178 http://secunia.com/advisories/23001	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2005-4226`	vulnerable	2026-06-08 04:48:43.282519	Details available Multiple "potential" SQL injection vulnerabilities in phpWebThings 1.4 Patched might allow remote attackers to execute arbitrary SQL commands via (1) the ref parameter in download.php, (2) the direction, msg, sforum, reason, subname, and toform parameters in forum.php, (3) the msg and forum parameters in forum_edit.php, (4) the msg and forum parameters in forum_write.php, (5) the tekst parameter in guestbook.php, (6) the menuoption parameter in index.php, and the (7) sel_avatar parameter in myaccount.php. NOTE: the forum.php/forum vector is already identified by CVE-2005-3585. Published: 2005-12-14T11:00:00.000Z Updated: 2024-08-07T23:38:51.596Z Open on db.gcve.eu Reference links http://www.securityfocus.com/archive/1/419280/100/0/threaded http://www.osvdb.org/21653 http://www.osvdb.org/21650 http://www.vupen.com/english/advisories/2005/2860 http://secunia.com/advisories/18011/	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Phpwebthings

Notes

PURL mappings

Vulnerability references

Contribute