GCVE - cpe:2.3:a:visualshapers:ezcontents:2.0.3:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:visualshapers:ezcontents:2.0.3:*:*:*:*:*:*:*

part: a version: 2.0.3 update: *

Vendor	Visualshapers (`d2b619ab-2671-5d71-9781-2f59f896ee7d`)
Product	Ezcontents (`8595c88c-a1cf-5a4b-b98c-a0a7ac458d1c`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2008-7055`	vulnerable	2026-06-08 04:51:05.513947	Details available module.php in ezContents 2.0.3 allows remote attackers to bypass the directory traversal protection mechanism to include and execute arbitrary local files via "....//" (doubled dot dot slash) sequences in the link parameter, which is not properly filtered using the str_replace function. Published: 2009-08-24T19:00:00.000Z Updated: 2024-08-07T11:49:03.082Z Open on db.gcve.eu Reference links http://www.securityfocus.com/archive/1/495705/100/100/threaded https://www.exploit-db.com/exploits/6301 http://secunia.com/advisories/31606 http://www.securityfocus.com/bid/30821 https://exchange.xforce.ibmcloud.com/vulnerabilities/44663	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2008-7054`	vulnerable	2026-06-08 04:51:05.513521	Details available Multiple directory traversal vulnerabilities in ezContents 2.0.3 allow remote attackers to include and execute arbitrary local files via the (1) gsLanguage and (2) language_home parameters to modules/diary/showdiary.php; (3) admin_home, (4) gsLanguage, and (5) language_home parameters to modules/diary/showdiarydetail.php; (6) gsLanguage and (7) language_home parameters to modules/diary/submit_diary.php; (8) admin_home parameter to modules/news/news_summary.php; (9) nLink, (10) gsLanguage, and (11) language_home parameters to modules/news/inlinenews.php; and possibly other unspecified vectors in (12) diary/showeventlist.php, (13) gallery/showgallery.php, (14) reviews/showreviews.php, (15) gallery/showgallerydetails.php, (16) reviews/showreviewsdetails.php, (17) news/shownewsdetails.php, (18) gallery/submit_gallery.php, (19) guestbook/submit_guestbook.php, (20) reviews/submit_reviews.php, (21) news/submit_news.php, (22) diary/inlineeventlist.php, and (23) news/archivednews_summary.php in modules/, related to the lack of directory traversal protection in modules/moduleSec.php. Published: 2009-08-24T19:00:00.000Z Updated: 2024-08-07T11:49:02.996Z Open on db.gcve.eu Reference links http://www.securityfocus.com/archive/1/495705/100/100/threaded http://www.osvdb.org/47777 http://www.osvdb.org/47773 https://www.exploit-db.com/exploits/6301 http://secunia.com/advisories/31606	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2006-4479`	vulnerable	2026-06-08 04:49:17.992175	Details available Cross-site scripting (XSS) vulnerability in loginreq2.php in Visual Shapers ezContents 2.0.3 allows remote attackers to inject arbitrary web script or HTML via the subgroupname parameter. Published: 2006-08-31T21:00:00.000Z Updated: 2024-08-07T19:14:46.656Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/19780 http://securityreason.com/securityalert/1479 http://securitytracker.com/id?1016770 http://www.vupen.com/english/advisories/2006/3420 http://secunia.com/advisories/21703	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2006-4478`	vulnerable	2026-06-08 04:49:17.991820	Details available SQL injection vulnerability in headeruserdata.php in Visual Shapers ezContents 2.0.3 allows remote attackers to execute arbitrary SQL commands via the groupname parameter. Published: 2006-08-31T21:00:00.000Z Updated: 2024-08-07T19:14:47.461Z Open on db.gcve.eu Reference links http://securityreason.com/securityalert/1479 http://securitytracker.com/id?1016770 http://www.vupen.com/english/advisories/2006/3420 http://www.osvdb.org/28320 https://exchange.xforce.ibmcloud.com/vulnerabilities/28675	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2006-4477`	vulnerable	2026-06-08 04:49:17.991366	Details available Multiple PHP remote file inclusion vulnerabilities in Visual Shapers ezContents 2.0.3 allow remote attackers to execute arbitrary PHP code via an empty GLOBALS[rootdp] parameter and an ftps URL in the (1) GLOBALS[admin_home] parameter in (a) diary/event_list.php, (b) gallery/gallery_summary.php, (c) guestbook/showguestbook.php, (d) links/showlinks.php, and (e) reviews/review_summary.php; and the (2) GLOBALS[language_home] parameter in (f) calendar/calendar.php, (g) news/shownews.php, (h) poll/showpoll.php, (i) search/search.php, (j) toprated/toprated.php, and (k) whatsnew/whatsnew.php. Published: 2006-08-31T21:00:00.000Z Updated: 2024-08-07T19:14:47.478Z Open on db.gcve.eu Reference links http://www.osvdb.org/28325 http://www.osvdb.org/28330 http://www.osvdb.org/28331 http://www.osvdb.org/28329 http://securityreason.com/securityalert/1479	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Ezcontents

Notes

PURL mappings

Vulnerability references

Contribute