Bti Tracker

bti-tracker

5 CVEs • 1 product

Products (1)

Click to collapse

Toggle

CVEs (5)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2007-5988 1Bti Tracker 1Bti Tracker Apr 23, 2026 Nov 15, 2007 N/A· v4 N/A· v3 7.5 HIGH· v2 blocks/shoutbox_block.php in BtiTracker 1.4.4 does not verify user accounts, which allows remote attackers to post shoutbox entries as arbitrary users via a modified nick field.
CVE-2007-5987 1Bti Tracker 1Bti Tracker Apr 23, 2026 Nov 15, 2007 N/A· v4 N/A· v3 6.8 MEDIUM· v2 details.php in BtiTracker before 1.4.5, when torrent viewing is disabled for guests, allows remote attackers to bypass protection mechanisms via a direct request, as demonstrated by (1) reading the details of an arbitrar...Show more details.php in BtiTracker before 1.4.5, when torrent viewing is disabled for guests, allows remote attackers to bypass protection mechanisms via a direct request, as demonstrated by (1) reading the details of an arbitrary torrent and (2) modifying a torrent owned by a guest.Show less
CVE-2007-5985 1Bti Tracker 1Bti Tracker Apr 23, 2026 Nov 15, 2007 N/A· v4 N/A· v3 4.3 MEDIUM· v2 Multiple cross-site scripting (XSS) vulnerabilities in BtiTracker before 1.4.5 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to (1) account.php, (2) moresmiles.php, or (3) recover....Show more Multiple cross-site scripting (XSS) vulnerabilities in BtiTracker before 1.4.5 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to (1) account.php, (2) moresmiles.php, or (3) recover.php; or (4) the "to" parameter to usercp.php.Show less
CVE-2007-2854 1Bti Tracker 1Bti Tracker Apr 23, 2026 May 24, 2007 N/A· v4 N/A· v3 7.5 HIGH· v2 Multiple SQL injection vulnerabilities in account_change.php in BtiTracker 1.4.1 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) style or (2) langue parameter.
CVE-2006-7159 2Bti Tracker Btitracker 2Bti Tracker Btitracker Apr 23, 2026 Mar 7, 2007 N/A· v4 N/A· v3 6.4 MEDIUM· v2 Directory traversal vulnerability in include/prune_torrents.php in BTI-Tracker 1.3.2 (aka btitracker) allows remote attackers to delete arbitrary files via ".." sequences in the TORRENTSDIR parameter in a prune action.