Vwar » Virtual War » 1.0.5 : Security Vulnerabilities, CVEs, Published In 2006
Cross-site scripting (XSS) vulnerability in calendar.php in Virtual War (VWar) 1.5.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the year parameter. NOTE: The page parameter vector is covered by CVE-2006-4009.
Max CVSS
4.3
EPSS Score
0.26%
Published
2006-08-18
Updated
2018-10-17
SQL injection vulnerability in news.php in Virtual War (VWar) 1.5.0 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) sortby and (2) sortorder parameters.
Max CVSS
7.5
EPSS Score
0.32%
Published
2006-08-14
Updated
2018-10-17
Multiple SQL injection vulnerabilities in war.php in Virtual War (VWar) 1.5.0 R14 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) s, (2) showgame, (3) sortorder, and (4) sortby parameters.
Max CVSS
7.5
EPSS Score
0.64%
Published
2006-06-22
Updated
2018-10-18
admin.php in Virtual War (VWar) 1.5 and versions before 1.2 allows remote attackers to obtain sensitive information via an invalid vwar_root parameter, which reveals the path in an error message.
Max CVSS
5.0
EPSS Score
0.63%
Published
2006-04-29
Updated
2018-10-18
PHP remote file inclusion vulnerability in get_header.php in VWar 1.5.0 R12 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the vwar_root parameter. NOTE: this is a different vulnerability than CVE-2006-1503.
Max CVSS
7.5
EPSS Score
4.32%
Published
2006-04-06
Updated
2018-10-18
PHP remote file inclusion vulnerability in includes/functions_install.php in Virtual War (VWar) 1.5.0 R11 and earlier allows remote attackers to include and execute arbitrary PHP code via a URL in the vwar_root parameter. NOTE: this is a different vulnerability than CVE-2006-1636.
Max CVSS
5.1
EPSS Score
5.80%
Published
2006-03-30
Updated
2018-10-18
6 vulnerabilities found