← Back

Xoops

xoops

87 CVEs • 43 products

Products (43)

Click to collapse
Toggle
Xoops
xoops
43 CVEs
Xoops Glossaire Module
xoops_glossaire_module
2 CVEs
Xoops Rmsoft Gallery System
xoops_rmsoft_gallery_system
2 CVEs
Tutoriais Module
tutoriais_module
2 CVEs
Xm Memberstats
xm_memberstats
2 CVEs
Xoops Dictionary
xoops_dictionary
1 CVE
Wf Downloads
wf-downloads
1 CVE
Xoops Pool Module
xoops_pool_module
1 CVE
Core Module
core_module
1 CVE
Library Module
library_module
1 CVE
Friendfinder Module
friendfinder_module
1 CVE
Malaika System Myads Module
malaika_system_myads_module
1 CVE
Repository Module
repository_module
1 CVE
Rha7 Downloads Module
rha7_downloads_module
1 CVE
Wf Snippets
wf-snippets
1 CVE
Happy Linux Xfsection Module
happy_linux_xfsection_module
1 CVE
Zmagazine Module
zmagazine_module
1 CVE
Xoops Virii Info Module
xoops_virii_info_module
1 CVE
Xoops Popnupblog
xoops_popnupblog
1 CVE
John Mordo Jobs Module
john_mordo_jobs_module
1 CVE
Flashgames Module
flashgames_module
1 CVE
Wfquotes Module
wfquotes_module
1 CVE
Myconference Module
myconference_module
1 CVE
Icontent Module
icontent_module
1 CVE
Cjay Content Module
cjay_content_module
1 CVE
Xt Conteudo Module
xt-conteudo_module
1 CVE
Xfsection Module
xfsection_module
1 CVE
Horoscope Module
horoscope_module
1 CVE
Tinycontent Module
tinycontent_module
1 CVE
Wiwimod Module
wiwimod_module
1 CVE
Articles Module
articles_module
1 CVE
Mylinks Module
mylinks_module
1 CVE
Xoopsgallery Module
xoopsgallery_module
1 CVE
Mytopics
mytopics
1 CVE
Eempregos Module
eempregos_module
1 CVE
Prayer List Module
prayer_list_module
1 CVE
Tiny Event Module
tiny_event_module
1 CVE
Xoops Cube
xoops_cube
1 CVE
Article Module
article_module
1 CVE
Kshop Module
kshop_module
1 CVE
Makale
makale
1 CVE
Uploader
uploader
1 CVE
Glossaire Module
glossaire_module
1 CVE

CVEs (87)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2007-1847
1Xoops
1Repository Module
Apr 23, 2026
Apr 3, 2007
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in viewcat.php in the Repository module for Xoops allows remote attackers to execute arbitrary SQL commands via the cid parameter.
CVE-2007-1846
1Xoops
1Malaika System Myads Module
Apr 23, 2026
Apr 3, 2007
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in index.php in the MyAds 2.04jp and earlier module for Xoops allows remote attackers to execute arbitrary SQL commands via the cid parameter, different vectors than CVE-2006-3341.
CVE-2007-1838
1Xoops
1Friendfinder Module
Apr 23, 2026
Apr 3, 2007
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in view.php in the Friendfinder 3.3 and earlier module for Xoops allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVE-2007-1816
1Xoops
1Tutoriais Module
Apr 23, 2026
Apr 2, 2007
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in viewcat.php in the Tutoriais module for Xoops allows remote attackers to execute arbitrary SQL commands via the cid parameter.
CVE-2007-1815
1Xoops
1Library Module
Apr 23, 2026
Apr 2, 2007
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in viewcat.php in the Library module for Xoops allows remote attackers to execute arbitrary SQL commands via the cid parameter.
CVE-2007-1814
1Xoops
1Core Module
Apr 23, 2026
Apr 2, 2007
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in viewcat.php in the Core module for Xoops allows remote attackers to execute arbitrary SQL commands via the cid parameter, a different vector than CVE-2007-0377.
CVE-2007-0377
1Xoops
1Xoops
Apr 23, 2026
Jan 19, 2007
N/A· v4
N/A· v3
7.5 HIGH· v2
Multiple SQL injection vulnerabilities in Xoops 2.0.16 allow remote attackers to execute arbitrary SQL commands via (1) the id parameter in kernel/group.php in core, (2) the lid parameter in class/table_broken.php in the...Show more
Multiple SQL injection vulnerabilities in Xoops 2.0.16 allow remote attackers to execute arbitrary SQL commands via (1) the id parameter in kernel/group.php in core, (2) the lid parameter in class/table_broken.php in the Weblinks module, and other unspecified vectors.Show less
CVE-2006-5810
1Xoops
1Xoops
Apr 23, 2026
Nov 8, 2006
N/A· v4
N/A· v3
6.8 MEDIUM· v2
Cross-site scripting (XSS) vulnerability in modules/wfdownloads/newlist.php in XOOPS 1.0 allows remote attackers to inject arbitrary web script or HTML via the newdownloadshowdays parameter.
CVE-2006-5532
1Xoops
1Xoops Rmsoft Gallery System
Apr 23, 2026
Oct 26, 2006
N/A· v4
N/A· v3
6.8 MEDIUM· v2
Cross-site scripting (XSS) vulnerability in rmgs/images.php in RMSOFT Gallery System 2.0 allows remote attackers to inject arbitrary web script or HTML via the kw parameter. NOTE: some of these details are obtained from...Show more
Cross-site scripting (XSS) vulnerability in rmgs/images.php in RMSOFT Gallery System 2.0 allows remote attackers to inject arbitrary web script or HTML via the kw parameter. NOTE: some of these details are obtained from third party information.Show less
CVE-2006-4417
1Xoops
1Xoops
Apr 16, 2026
Aug 28, 2006
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in edituser.php in Xoops before 2.0.15 allows remote attackers to execute arbitrary SQL commands via the user_avatar parameter.
CVE-2006-3363
1Xoops
1Xoops Glossaire Module
Apr 16, 2026
Jul 6, 2006
N/A· v4
N/A· v3
5.1 MEDIUM· v2
PHP remote file inclusion vulnerability in index.php in the Glossaire module 1.7 for Xoops allows remote attackers to execute arbitrary PHP code via a URL in the pa parameter.
CVE-2006-2516
1Xoops
1Xoops
Apr 16, 2026
May 22, 2006
N/A· v4
N/A· v3
5.1 MEDIUM· v2
mainfile.php in XOOPS 2.0.13.2 and earlier, when register_globals is enabled, allows remote attackers to overwrite variables such as $xoopsOption['nocommon'] and conduct directory traversal attacks or include PHP files v...Show more
mainfile.php in XOOPS 2.0.13.2 and earlier, when register_globals is enabled, allows remote attackers to overwrite variables such as $xoopsOption['nocommon'] and conduct directory traversal attacks or include PHP files via (1) xoopsConfig[language] to misc.php or (2) xoopsConfig[theme_set] to index.php, as demonstrated by injecting PHP sequences into a log file.Show less
CVE-2006-0198
1Xoops
1Xoops Pool Module
Apr 16, 2026
Jan 13, 2006
N/A· v4
N/A· v3
4.3 MEDIUM· v2
Cross-site scripting (XSS) vulnerability in a certain module, possibly poll or Pool, for XOOPS allows remote attackers to inject arbitrary web script or HTML via JavaScript in the SRC attribute of an IMG element in a com...Show more
Cross-site scripting (XSS) vulnerability in a certain module, possibly poll or Pool, for XOOPS allows remote attackers to inject arbitrary web script or HTML via JavaScript in the SRC attribute of an IMG element in a comment.Show less
CVE-2005-3681
1Xoops
1Wf Downloads
Apr 16, 2026
Nov 18, 2005
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in viewcat.php in XOOPS WF-Downloads module 2.05 allows remote attackers to execute arbitrary SQL commands via the list parameter.
CVE-2005-3680
1Xoops
1Xoops
Apr 16, 2026
Nov 18, 2005
N/A· v4
N/A· v3
6.4 MEDIUM· v2
Directory traversal vulnerability in editor_registry.php in XOOPS 2.2.3 allows remote attackers to read or include arbitrary local files via a .. (dot dot) in the xoopsConfig[language] parameter.
CVE-2005-2338
1Xoops
1Xoops
Apr 16, 2026
Oct 27, 2005
N/A· v4
N/A· v3
4.3 MEDIUM· v2
Multiple cross-site scripting (XSS) vulnerabilities in XOOPS 2.0.12 JP and earlier, XOOPS 2.0.13.1 and earlier, and 2.2.x up to 2.2.3 RC1 allow remote attackers to inject arbitrary web script or HTML via (1) modules that...Show more
Multiple cross-site scripting (XSS) vulnerabilities in XOOPS 2.0.12 JP and earlier, XOOPS 2.0.13.1 and earlier, and 2.2.x up to 2.2.3 RC1 allow remote attackers to inject arbitrary web script or HTML via (1) modules that use "XOOPS Code" and (2) newbb in the forum module.Show less
CVE-2005-2113
1Xoops
1Xoops
Apr 16, 2026
Jul 5, 2005
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in the loginUser function in the XMLRPC server in XOOPS 2.0.11 and earlier allows remote attackers to execute arbitrary SQL commands and bypass authentication via crafted values in an XML file...Show more
SQL injection vulnerability in the loginUser function in the XMLRPC server in XOOPS 2.0.11 and earlier allows remote attackers to execute arbitrary SQL commands and bypass authentication via crafted values in an XML file, as demonstrated using the blogger.getPost method.Show less
CVE-2005-2112
1Xoops
1Xoops
Apr 16, 2026
Jul 5, 2005
N/A· v4
N/A· v3
4.3 MEDIUM· v2
Multiple cross-site scripting (XSS) vulnerabilities in XOOPS 2.0.11 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) order parameter to edit.php or (2) cid parameter to comment_edit.p...Show more
Multiple cross-site scripting (XSS) vulnerabilities in XOOPS 2.0.11 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) order parameter to edit.php or (2) cid parameter to comment_edit.php.Show less
CVE-2005-0743
1Xoops
1Xoops
Apr 16, 2026
May 2, 2005
N/A· v4
N/A· v3
7.5 HIGH· v2
The custom avatar uploading feature (uploader.php) for XOOPS 2.0.9.2 and earlier allows remote attackers to upload arbitrary PHP scripts, whose file extensions are not filtered.
CVE-2004-2756
1Xoops
1Xoops
Apr 16, 2026
Dec 31, 2004
N/A· v4
N/A· v3
4.3 MEDIUM· v2
Cross-site scripting (XSS) vulnerability in viewtopic.php in Xoops 2.x, possibly 2 through 2.0.5, allows remote attackers to inject arbitrary web script or HTML via the (1) forum and (2) topic_id parameters.