Efiction

efiction

CVEs (7)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2005-4173 1Efiction Project 1Efiction Apr 16, 2026 Dec 11, 2005 N/A· v4 N/A· v3 5.0 MEDIUM· v2 eFiction 1.0, 1.1, and 2.0 allows remote attackers to obtain sensitive information by accessing phpinfo.php, which executes the PHP phpinfo function.
CVE-2005-4172 1Efiction Project 1Efiction Apr 16, 2026 Dec 11, 2005 N/A· v4 N/A· v3 5.0 MEDIUM· v2 eFiction 1.0, 1.1, and 2.0 allows remote attackers to obtain sensitive information via a direct request to storyblock.php without arguments, which leaks the full pathname in the resulting PHP error message.
CVE-2005-4171 1Efiction Project 1Efiction Apr 16, 2026 Dec 11, 2005 N/A· v4 N/A· v3 7.5 HIGH· v2 The "Upload new image" command in the "Manage Images" eFiction 1.1, when members are allowed to upload images, allows remote attackers to execute arbitrary PHP code by uploading a filename with a .php extension that cont...Show more The "Upload new image" command in the "Manage Images" eFiction 1.1, when members are allowed to upload images, allows remote attackers to execute arbitrary PHP code by uploading a filename with a .php extension that contains a GIF header, which passes the image validity check but executes any PHP code within the file.Show less
CVE-2005-4170 1Efiction Project 1Efiction Apr 16, 2026 Dec 11, 2005 N/A· v4 N/A· v3 7.5 HIGH· v2 SQL injection vulnerability in eFiction 1.1 allows remote attackers to execute arbitrary SQL commands via the uid parameter to viewuser.php.
CVE-2005-4169 1Efiction Project 1Efiction Apr 16, 2026 Dec 11, 2005 N/A· v4 N/A· v3 7.5 HIGH· v2 Multiple SQL injection vulnerabilities in eFiction 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) let parameter in a viewlist action to authors.php and (2) sid parameter to viewstory.php.
CVE-2005-4168 1Efiction Project 1Efiction Apr 16, 2026 Dec 11, 2005 N/A· v4 N/A· v3 7.5 HIGH· v2 Multiple SQL injection vulnerabilities in eFiction 1.0, 1.1, and 2.0 allow remote attackers to execute arbitrary SQL commands via (1) the let parameter in a viewlist action to titles.php and (2) the username.
CVE-2005-4167 1Efiction Project 1Efiction Apr 16, 2026 Dec 11, 2005 N/A· v4 N/A· v3 4.3 MEDIUM· v2 Cross-site scripting (XSS) vulnerability in eFiction 1.0 and 1.1 allows remote attackers to inject arbitrary web script or HTML via the let parameter in a viewlist action to titles.php.