Approved changes feed: RSS · Atom
cpe:2.3:a:w-agora:w-agora:4.2.1:*:*:*:*:*:*:*part: a version: 4.2.1 update: *
| Vendor | W Agora (4e95a7f5-1046-53cb-a95c-0acaea291f2c) |
|---|---|
| Product | W Agora (0d95fdc1-6479-513c-a98c-5d9e487bde5f) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2007-1607 |
vulnerable | 2026-06-08 04:49:43.062409 |
Details available
search.php in w-Agora (Web-Agora) allows remote attackers to obtain potentially sensitive information via a ' (quote) value followed by certain SQL sequences in the (1) search_forum or (2) search_user parameter, which force a SQL error.
Published: 2007-03-22T23:00:00.000Z
Updated: 2024-08-07T13:06:25.077Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2007-1606 |
vulnerable | 2026-06-08 04:49:43.062077 |
Details available
Multiple cross-site scripting (XSS) vulnerabilities in w-Agora (Web-Agora) allow remote attackers to inject arbitrary web script or HTML via (1) the showuser parameter to profile.php, the (2) search_forum or (3) search_user parameter to search.php, or (4) the userid parameter to change_password.php.
Published: 2007-03-22T23:00:00.000Z
Updated: 2024-08-07T13:06:25.034Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2007-1605 |
vulnerable | 2026-06-08 04:49:43.061717 |
Details available
w-Agora (Web-Agora) allows remote attackers to obtain sensitive information via a request to rss.php with an invalid (1) site or (2) bn parameter, (3) a certain value of the site[] parameter, or (4) an empty value of the bn[] parameter; a request to index.php with a certain value of the (5) site[] or (6) sort[] parameter; (7) a request to profile.php with an empty value of the site[] parameter; or a request to search.php with (8) an empty value of the bn[] parameter or a certain value of the (9) pattern[] or (10) search_date[] parameter, which reveal the path in various error messages, probably related to variable type inconsistencies. NOTE: the bn[] parameter to index.php is already covered by CVE-2007-0606.1.
Published: 2007-03-22T23:00:00.000Z
Updated: 2024-08-07T12:59:08.993Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2007-1604 |
vulnerable | 2026-06-08 04:49:43.061274 |
Details available
Multiple unrestricted file upload vulnerabilities in w-Agora (Web-Agora) allow remote attackers to upload and execute arbitrary PHP code (1) via a forum message with an attached file, which is stored under forums/hello/hello/notes/ or (2) by using browse_avatar.php to upload a file with a double extension, as demonstrated by .php.jpg.
Published: 2007-03-22T23:00:00.000Z
Updated: 2024-08-07T12:59:08.814Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2007-0607 |
vulnerable | 2026-06-08 04:49:32.868731 |
Details available
W-Agora (Web-Agora) 4.2.1, when register_globals is enabled, stores globals.inc under the web document root with insufficient access control, which allows remote attackers to obtain application path information via a direct request.
Published: 2007-03-20T20:00:00.000Z
Updated: 2024-08-07T12:26:53.470Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2007-0606 |
vulnerable | 2026-06-08 04:49:32.868330 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.