Butterfly Organizer

butterfly_organizer

CVEs (4)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2008-7181 1Butterflymedia 1Butterfly Organizer Apr 23, 2026 Sep 8, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 Butterfly Organizer 2.0.0 allows remote attackers to (1) delete arbitrary categories via a modified tablehere parameter to category-delete.php with the is_js_confirmed parameter set to 1, or (2) delete arbitrary accounts...Show more Butterfly Organizer 2.0.0 allows remote attackers to (1) delete arbitrary categories via a modified tablehere parameter to category-delete.php with the is_js_confirmed parameter set to 1, or (2) delete arbitrary accounts via the mytable parameter to delete.php.Show less
CVE-2008-6700 1Butterflymedia 1Butterfly Organizer Apr 23, 2026 Apr 10, 2009 N/A· v4 N/A· v3 4.3 MEDIUM· v2 Multiple cross-site scripting (XSS) vulnerabilities in Butterfly Organizer 2.0.0 allow remote attackers to inject arbitrary web script or HTML via the (1) mytable parameter to view.php, (2) mytable parameter to viewdb2.p...Show more Multiple cross-site scripting (XSS) vulnerabilities in Butterfly Organizer 2.0.0 allow remote attackers to inject arbitrary web script or HTML via the (1) mytable parameter to view.php, (2) mytable parameter to viewdb2.php, (3) tablehere parameter to category-rename.php, and (4) letter parameter to module-contacts.php.Show less
CVE-2008-6328 1Butterflymedia 1Butterfly Organizer Apr 23, 2026 Feb 27, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 SQL injection vulnerability in view.php in Butterfly Organizer 2.0.0 and 2.0.1 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVE-2008-6311 1Butterflymedia 1Butterfly Organizer Apr 23, 2026 Feb 27, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 SQL injection vulnerability in view.php in Butterfly Organizer 2.0.1 allows remote attackers to execute arbitrary SQL commands via the mytable parameter. NOTE: the id vector is covered by another CVE name.