← Back

Factosystem Weblog

factosystem_weblog

Vendor: Factosystem • 2 CVEs

CVEs (2)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2008-5935
1Factosystem
1Factosystem Weblog
Apr 23, 2026
Jan 21, 2009
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Facto stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file containing the password via a direct request for database/facto.mdb. NO...Show more
Facto stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file containing the password via a direct request for database/facto.mdb. NOTE: some of these details are obtained from third party information.Show less
CVE-2002-1499
1Factosystem
1Factosystem Weblog
Apr 16, 2026
Apr 2, 2003
N/A· v4
N/A· v3
7.5 HIGH· v2
Multiple SQL injection vulnerabilities in FactoSystem CMS allows remote attackers to perform unauthorized database actions via (1) the authornumber parameter in author.asp, (2) the discussblurbid parameter in discuss.asp...Show more
Multiple SQL injection vulnerabilities in FactoSystem CMS allows remote attackers to perform unauthorized database actions via (1) the authornumber parameter in author.asp, (2) the discussblurbid parameter in discuss.asp, (3) the name parameter in holdcomment.asp, and (4) the email parameter in holdcomment.asp.Show less