Skip to content
Noroxi

auracms records

18 published records for vendor auracms.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
11
With a fix record
0%
Median publish → KEV
No record has entered KEV

Records by year

  1. 18

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

18 records
  • CVE-2008-0735
    40Plan

    SQL injection vulnerability in mod/gallery/ajax/gallery_data.php in AuraCMS 2.2 allows remote attackers to execute arbitrary SQL commands vi

    CriticalCVSS 10.0Proof of conceptEPSS 1%

    auracms · auracmsFeb 12, 2008

  • CVE-2018-16338
    35Monitor

    An issue was discovered in AuraCMS 2.3.

    HighCVSS 8.8No exploitEPSS 0%

    auracms · auracmsSep 2, 2018

  • CVE-2007-4905
    32Monitor

    Unrestricted file upload vulnerability in mod/contak.php in AuraCMS 2.1 allows remote attackers to upload and execute arbitrary PHP files vi

    HighCVSS 7.5Proof of conceptEPSS 7%

    auracms · auracmsSep 17, 2007

  • CVE-2007-4804
    31Monitor

    Multiple SQL injection vulnerabilities in AuraCMS 1.5rc allow remote attackers to execute arbitrary SQL commands via the id parameter in (1)

    HighCVSS 7.5Proof of conceptEPSS 3%

    auracms · auracmsSep 11, 2007

  • CVE-2007-4908
    31Monitor

    Directory traversal vulnerability in index.php in AuraCMS 2.1 and earlier allows remote attackers to include and execute arbitrary local fil

    HighCVSS 7.5Proof of conceptEPSS 2%

    auracms · auracmsSep 17, 2007

  • CVE-2008-3203
    31Monitor

    js/pages/pages_data.php in AuraCMS 2.2 through 2.2.2 does not perform authentication, which allows remote attackers to add, edit, and delete

    HighCVSS 7.5Proof of conceptEPSS 2%

    auracms · auracmsJul 17, 2008

  • CVE-2008-0390
    31Monitor

    stat.php in AuraCMS 1.62, and Mod Block Statistik for AuraCMS, allows remote attackers to inject arbitrary PHP code into online.db.txt via t

    HighCVSS 7.5Proof of conceptEPSS 2%

    auracms · auracmsJan 22, 2008

  • CVE-2007-4171
    30Monitor

    SQL injection vulnerability in komentar.php in the Forum Module for auraCMS (Modul Forum Sederhana) allows remote attackers to execute arbit

    HighCVSS 7.5Proof of conceptEPSS 1%

    auracms · modul forum sederhanaAug 7, 2007

  • CVE-2008-0811
    30Monitor

    Multiple SQL injection vulnerabilities in AuraCMS 1.62 allow remote attackers to execute arbitrary SQL commands via (1) the kid parameter to

    HighCVSS 7.5Proof of conceptEPSS 0%

    auracms · auracmsFeb 18, 2008

  • CVE-2010-4774
    30Monitor

    SQL injection vulnerability in pdf.php in AuraCMS 1.62 allows remote attackers to execute arbitrary SQL commands via the id parameter, a dif

    HighCVSS 7.5Proof of conceptEPSS 0%

    auracms · auracmsMar 23, 2011

  • CVE-2007-4886
    28Monitor

    Incomplete blacklist vulnerability in index.php in AuraCMS 1.x and probably 2.x allows remote attackers to execute arbitrary PHP code via a

    MediumCVSS 6.8Proof of conceptEPSS 2%

    auracms · auracmsSep 13, 2007

  • CVE-2014-1401
    27Monitor

    Multiple SQL injection vulnerabilities in AuraCMS 2.3 and earlier allow remote authenticated users to execute arbitrary SQL commands via the

    MediumCVSS 6.5Proof of conceptEPSS 2%

    auracms · auracmsFeb 11, 2014

  • CVE-2008-1715
    27Monitor

    SQL injection vulnerability in content/user.php in AuraCMS 2.2.1 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to

    MediumCVSS 6.8Proof of conceptEPSS 0%

    auracms · auracmsApr 9, 2008

  • CVE-2008-1398
    27Monitor

    SQL injection vulnerability in online.php in AuraCMS 2.0 through 2.2.1 allows remote attackers to execute arbitrary SQL commands via the X-F

    MediumCVSS 6.8Proof of conceptEPSS 0%

    auracms · auracmsMar 20, 2008

  • CVE-2007-6552
    24Monitor

    Directory traversal vulnerability in index.php in AuraCMS 2.2 allows remote authenticated users to include and execute arbitrary local files

    MediumCVSS 6.0Proof of conceptEPSS 1%

    auracms · auracmsDec 27, 2007

  • CVE-2014-3975
    22Monitor

    Absolute path traversal vulnerability in filemanager.php in AuraCMS 3.0 allows remote attackers to list a directory via a full pathname in t

    MediumCVSS 5.0Proof of conceptEPSS 6%

    auracms · auracmsJun 5, 2014

  • CVE-2018-15199
    21Monitor

    AuraCMS 2.3 allows XSS via a Bukutamu -> AddGuestbook action.

    MediumCVSS 5.4No exploitEPSS 0%

    auracms · auracmsAug 7, 2018

  • CVE-2014-3974
    18Monitor

    Cross-site scripting (XSS) vulnerability in filemanager.php in AuraCMS 3.0 and earlier allows remote attackers to inject arbitrary web scrip

    MediumCVSS 4.3Proof of conceptEPSS 3%

    auracms · auracmsJun 5, 2014