GCVE - cpe:2.3:a:xcms:xcms:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:xcms:xcms:*:*:*:*:*:*:*:*

part: a version: * update: *

Notes

Imported from gcve-enriched-dumps CVE data

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2007-6652`	vulnerable	2026-06-08 04:50:09.263808	Details available cpie.php in XCMS 1.83 and earlier sends a redirect to the web browser but does not exit, which allows remote attackers to conduct direct static code injection attacks and execute arbitrary code via the testo_0 parameter in a cpie admin action to index.php, which writes to dati/generali/footer.dtb (aka the XCMS footer). Published: 2008-01-04T11:00:00.000Z Updated: 2024-08-07T16:18:19.269Z Open on db.gcve.eu Reference links https://www.exploit-db.com/exploits/4813 https://exchange.xforce.ibmcloud.com/vulnerabilities/39346 http://secunia.com/advisories/28256 http://osvdb.org/40277	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2007-5060`	vulnerable	2026-06-08 04:49:57.782120	Details available Cross-site request forgery (CSRF) vulnerability in the cpass functionality in an admin action in index.php in XCMS allows remote attackers to change arbitrary passwords via certain password_ and rpassword_ parameters, possibly related to timestamp values. Published: 2007-09-24T22:00:00.000Z Updated: 2024-08-07T15:17:27.936Z Open on db.gcve.eu Reference links http://securityreason.com/securityalert/3165 https://exchange.xforce.ibmcloud.com/vulnerabilities/36755 http://www.securityfocus.com/bid/25771 http://www.securityfocus.com/archive/1/480326/100/0/threaded http://secunia.com/advisories/26941	Imported from gcve-enriched-dumps CVE data

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.