← Back

The Address Book

the_address_book

9 CVEs • 1 product

Products (1)

Click to collapse
Toggle
The Address Book
the_address_book
9 CVEs

CVEs (9)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2006-4582
1The Address Book
1The Address Book
Apr 23, 2026
Dec 31, 2006
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Cross-site request forgery (CSRF) vulnerability in The Address Book 1.04e allows remote attackers to perform unauthorized actions as other users via unspecified vectors, as demonstrated by deleting arbitrary users via th...Show more
Cross-site request forgery (CSRF) vulnerability in The Address Book 1.04e allows remote attackers to perform unauthorized actions as other users via unspecified vectors, as demonstrated by deleting arbitrary users via the id parameter in a deleteuser action in users.php.Show less
CVE-2006-4581
1The Address Book
1The Address Book
Apr 23, 2026
Dec 31, 2006
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Unrestricted file upload vulnerability in The Address Book 1.04e validates the Content-Type header but not the file extension, which allows remote attackers to upload arbitrary PHP scripts.
CVE-2006-4580
1The Address Book
1The Address Book
Apr 23, 2026
Dec 31, 2006
N/A· v4
N/A· v3
7.5 HIGH· v2
register.php in The Address Book 1.04e allows remote attackers to bypass the "Allow User Self-Registration" setting and create arbitrary users by setting the mode parameter to "confirm".
CVE-2006-4579
1The Address Book
1The Address Book
Apr 23, 2026
Dec 31, 2006
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Directory traversal vulnerability in users.php in The Address Book 1.04e allows remote attackers to include arbitrary files via a .. (dot dot) in the language parameter.
CVE-2006-4578
1The Address Book
1The Address Book
Apr 23, 2026
Dec 31, 2006
N/A· v4
N/A· v3
7.5 HIGH· v2
export.php in The Address Book 1.04e writes username and password hash information into a publicly accessible file when dumping the MySQL database contents, which allows remote attackers to obtain sensitive information.
CVE-2006-4577
1The Address Book
1The Address Book
Apr 23, 2026
Dec 31, 2006
N/A· v4
N/A· v3
6.8 MEDIUM· v2
Multiple cross-site scripting (XSS) vulnerabilities in The Address Book 1.04e allow remote attackers to inject arbitrary web script or HTML via Javascript events in the (1) email, (2) websites, and (3) groupAddName param...Show more
Multiple cross-site scripting (XSS) vulnerabilities in The Address Book 1.04e allow remote attackers to inject arbitrary web script or HTML via Javascript events in the (1) email, (2) websites, and (3) groupAddName parameters in (a) save.php; the (4) errorMsg parameter in (b) index.php; and the (5) goTo and (6) search parameters in (c) search.php.Show less
CVE-2006-4576
1The Address Book
1The Address Book
Apr 23, 2026
Dec 31, 2006
N/A· v4
N/A· v3
6.8 MEDIUM· v2
Cross-site scripting (XSS) vulnerability in The Address Book 1.04e allows remote attackers to inject arbitrary web script or HTML by uploading the HTML file with a GIF or JPG extension, which is rendered by Internet Expl...Show more
Cross-site scripting (XSS) vulnerability in The Address Book 1.04e allows remote attackers to inject arbitrary web script or HTML by uploading the HTML file with a GIF or JPG extension, which is rendered by Internet Explorer.Show less
CVE-2006-4575
1The Address Book
1The Address Book
Apr 23, 2026
Dec 31, 2006
N/A· v4
N/A· v3
7.5 HIGH· v2
Multiple SQL injection vulnerabilities in The Address Book 1.04e allow remote attackers to execute arbitrary SQL commands via the (1) lastname, (2) firstname, (3) passwordOld, (4) passwordNew, (5) id, (6) language, (7) d...Show more
Multiple SQL injection vulnerabilities in The Address Book 1.04e allow remote attackers to execute arbitrary SQL commands via the (1) lastname, (2) firstname, (3) passwordOld, (4) passwordNew, (5) id, (6) language, (7) defaultLetter, (8) newuserPass, (9) newuserType, (10) newuserEmail parameters in (a) user.php; the (11) goTo and (12) search parameters in (b) search.php; and the (13) groupAddName parameter in (c) save.php.Show less
CVE-2006-4056
2The Address Book
The Address Book Reloaded
2The Address Book
The Address Book Reloaded
Apr 16, 2026
Aug 10, 2006
N/A· v4
N/A· v3
7.5 HIGH· v2
Multiple SQL injection vulnerabilities in the authentication process in katzlbt (a) The Address Book 1.04e and earlier and (b) The Address Book Reloaded before 2.0-rc4 allow remote attackers to execute arbitrary SQL comm...Show more
Multiple SQL injection vulnerabilities in the authentication process in katzlbt (a) The Address Book 1.04e and earlier and (b) The Address Book Reloaded before 2.0-rc4 allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password parameters. NOTE: portions of these details are obtained from third party information.Show less