Overview 71 matches · 0 in Waratek scope · 0 protected · 1 exploited · 0 CISA KEV · 20 public PoC · 0 EPSS ≥ 0.5
71matches
0in Waratek scope0.0%
0protected0.0%
1exploited1.4%
0CISA KEV0.0%
20public PoC28.2%
0EPSS ≥ 0.50.0%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
0
0.0%
Not applicable
71
100.0%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
71
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
1
1.4%
Working exploit published
19
26.8%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
51
71.8%
split by
peak 11 / year
20031
Not applicable1
High1
not blocked1
Working exploit published1
20040
200510
Not applicable10
High8
Medium2
not blocked10
Working exploit published4
No public exploit6
200611
Not applicable11
High3
Medium8
not blocked11
Working exploit published3
No public exploit8
20074
Not applicable4
High3
Medium1
not blocked4
Working exploit published2
No public exploit2
200810
Not applicable10
High5
Medium5
not blocked10
Working exploit published7
No public exploit3
20093
Not applicable3
Medium3
not blocked3
Working exploit published1
No public exploit2
20100
20110
20121
Not applicable1
Medium1
not blocked1
Working exploit published1
20131
Not applicable1
Medium1
not blocked1
No public exploit1
20143
Not applicable3
High1
Medium1
Low1
not blocked3
No public exploit3
20150
20160
20173
Not applicable3
High1
Medium1
Low1
not blocked3
No public exploit3
20181
Not applicable1
Medium1
not blocked1
No public exploit1
20196
Not applicable6
Critical4
High1
Medium1
not blocked6
No public exploit6
20205
Not applicable5
Critical1
High1
Medium3
not blocked5
No public exploit5
20214
Not applicable4
High1
Medium3
not blocked4
Exploited1
No public exploit3
20220
20234
Not applicable4
Critical1
High2
Medium1
not blocked4
No public exploit4
20242
Not applicable2
Medium2
not blocked2
No public exploit2
20251
Not applicable1
Critical1
not blocked1
No public exploit1
20261
Not applicable1
Medium1
not blocked1
No public exploit1
200420062008201020122014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2025-36187 | Medium | 2026-03-25 | Not applicable | No public exploit | IBM Knowledge Catalog Standard Cartridge 5.0.0, 5.0.1, 5.0.2, 5.0.3, 5.1, 5.1.1, 5,1.2, 5.1.3, 5.2.0, 5.2.1 stores potentially sensitive information in log files that could be read by a local privileged user. |
| CVE-2024-37743 | Critical | 2025-06-24 | Not applicable | No public exploit | An issue in mmzdev KnowledgeGPT V.0.0.5 allows a remote attacker to execute arbitrary code via the Document Display Component. |
| CVE-2024-51677 | Medium | 2024-11-04 | Not applicable | No public exploit | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ajay Knowledge Base knowledgebase allows Stored XSS.This issue affects Knowledge Base: from n/a through <= 2.2.0. |
| CVE-2024-34685 | Medium | 2024-07-09 | Not applicable | No public exploit | Due to weak encoding of user-controlled input in SAP NetWeaver Knowledge Management XMLEditor which allows malicious scripts can be executed in the application, potentially leading to a Cross-Site Scripting (XSS) vulnerability. This has no impact on the availability of the application but it has a low impact on its confidentiality and integrity. |
| CVE-2023-5802 | High | 2023-10-26 | Not applicable | No public exploit | Cross-Site Request Forgery (CSRF) vulnerability in Mihai Iova WordPress Knowledge base & Documentation Plugin – WP Knowledgebase plugin <= 1.3.4 versions. |
| CVE-2023-28958 | High | 2023-07-10 | Not applicable | No public exploit | IBM Watson Knowledge Catalog on Cloud Pak for Data 4.0 is potentially vulnerable to CSV Injection. A remote attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 251782. |
| CVE-2023-28955 | Medium | 2023-07-10 | Not applicable | No public exploit | IBM Watson Knowledge Catalog on Cloud Pak for Data 4.0 could allow an authenticated user send a specially crafted request that could cause a denial of service. IBM X-Force ID: 251704. |
| CVE-2022-41731 | Critical | 2023-02-12 | Not applicable | No public exploit | IBM Watson Knowledge Catalog on Cloud Pak for Data 4.5.0 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 237402. |
| CVE-2021-42063 | Medium | 2021-12-14 | Not applicable | Exploited | A security vulnerability has been discovered in the SAP Knowledge Warehouse - versions 7.30, 7.31, 7.40, 7.50. The usage of one SAP KW component within a Web browser enables unauthorized attackers to conduct XSS attacks, which might lead to disclose sensitive data. |
| CVE-2021-37531 | High | 2021-09-14 | Not applicable | No public exploit | SAP NetWeaver Knowledge Management XML Forms versions - 7.10, 7.11, 7.30, 7.31, 7.40, 7.50, contains an XSLT vulnerability which allows a non-administrative authenticated attacker to craft a malicious XSL stylesheet file containing a script with OS-level commands, copy it into a location to be accessed by the system and then create a file which will trigger the XSLT engine to execute the script contained within the malicious XSL file. This can result in a full compromise of the confidentiality, integrity, and availability of the system. |
| CVE-2021-33707 | Medium | 2021-08-10 | Not applicable | No public exploit | SAP NetWeaver Knowledge Management allows remote attackers to redirect users to arbitrary websites and conduct phishing attacks via a URL stored in a component. This could enable the attacker to compromise the user's confidentiality and integrity. |
| CVE-2021-21488 | Medium | 2021-03-09 | Not applicable | No public exploit | Knowledge Management versions 7.01, 7.02, 7.30, 7.31, 7.40, 7.50 allows a remote attacker with basic privileges to deserialize user-controlled data without verification, leading to insecure deserialization which triggers the attacker’s code, therefore impacting Availability. |
| CVE-2020-6326 | Medium | 2020-09-09 | Not applicable | No public exploit | SAP NetWeaver (Knowledge Management), version-7.30,7.31,7.40,7.50, allows an authenticated attacker to create malicious links in the UI, when clicked by victim, will execute arbitrary java scripts thus extracting or modifying information otherwise restricted leading to Stored Cross Site Scripting. |
| CVE-2020-6293 | Medium | 2020-08-12 | Not applicable | No public exploit | SAP NetWeaver (Knowledge Management), versions - 7.30, 7.31, 7.40, 7.50, allows an unauthenticated attacker to upload a malicious file and also to access, modify or make unavailable existing files but the impact is limited to the files themselves and is restricted by other policies such as access control lists and other upload file size restrictions, leading to Unrestricted File Upload. |
| CVE-2020-6284 | Critical | 2020-08-12 | Not applicable | No public exploit | SAP NetWeaver (Knowledge Management), versions - 7.30, 7.31, 7.40, 7.50, allows the automatic execution of script content in a stored file due to inadequate filtering with the accessing user's privileges. If the accessing user has administrative privileges, then the execution of the script content could result in complete compromise of system confidentiality, integrity and availability, leading to Stored Cross Site Scripting. |
| CVE-2020-6225 | High | 2020-04-14 | Not applicable | No public exploit | SAP NetWeaver (Knowledge Management), versions (KMC-CM - 7.00, 7.01, 7.02, 7.30, 7.31, 7.40, 7.50 and KMC-WPC 7.30, 7.31, 7.40, 7.50), does not sufficiently validate path information provided by users, thus characters representing traverse to parent directory are passed through to the file APIs, allowing the attacker to overwrite, delete, or corrupt arbitrary files on the remote server, leading to Path Traversal. |
| CVE-2020-6193 | Medium | 2020-02-12 | Not applicable | No public exploit | SAP NetWeaver (Knowledge Management ICE Service), versions 7.30, 7.31, 7.40, 7.50, allows an unauthenticated attacker to execute malicious scripts leading to Reflected Cross-Site Scripting (XSS) vulnerability. |
| CVE-2019-4220 | Medium | 2019-06-06 | Not applicable | No public exploit | IBM InfoSphere Information Server 11.7.1.0 stores a common hard coded encryption key that could be used to decrypt sensitive information. IBM X-Force ID: 159229. |
| CVE-2014-9186 | Critical | 2019-04-08 | Not applicable | No public exploit | A file inclusion vulnerability exists in the confd.exe module in Honeywell Experion PKS R40x before R400.6, R41x before R410.6, and R43x before R430.2, which could lead to accepting an arbitrary file into the function, and potential information disclosure or remote code execution. Honeywell strongly encourages and recommends all customers running unsupported versions of EKPS prior to R400 to upgrade to a supported version. |
| CVE-2014-5436 | High | 2019-04-08 | Not applicable | No public exploit | A directory traversal vulnerability exists in the confd.exe module in Honeywell Experion PKS R40x before R400.6, R41x before R410.6, and R43x before R430.2, which could lead to possible information disclosure. Honeywell strongly encourages and recommends all customers running unsupported versions of EKPS prior to R400 to upgrade to a supported version. |
| CVE-2014-5435 | Critical | 2019-04-08 | Not applicable | No public exploit | An arbitrary memory write vulnerability exists in the dual_onsrv.exe module in Honeywell Experion PKS R40x before R400.6, R41x before R410.6, and R43x before R430.2, that could lead to possible remote code execution or denial of service. Honeywell strongly encourages and recommends all customers running unsupported versions of EKPS prior to R400 to upgrade to a supported version. |
| CVE-2014-9189 | Critical | 2019-03-25 | Not applicable | No public exploit | Multiple stack-based buffer overflow vulnerabilities were found in Honeywell Experion PKS all versions prior to R400.6, all versions prior to R410.6, and all versions prior to R430.2 modules that could lead to possible remote code execution, dynamic memory corruption, or denial of service. Honeywell strongly encourages and recommends all customers running unsupported versions of EKPS prior to R400 to upgrade to a supported version. |
| CVE-2014-9187 | Critical | 2019-03-25 | Not applicable | No public exploit | Multiple heap-based buffer overflow vulnerabilities exist in Honeywell Experion PKS all versions prior to R400.6, all versions prior to R410.6, and all versions prior to R430.2 modules, which could lead to possible remote code execution or denial of service. Honeywell strongly encourages and recommends all customers running unsupported versions of EKPS prior to R400 to upgrade to a supported version. |
| CVE-2018-12104 | Medium | 2018-06-17 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in Airbnb Knowledge Repo 0.7.4 allows remote attackers to inject arbitrary web scripts or HTML via the post comments functionality, as demonstrated by the post/posts/new_report.kp URI. |
| CVE-2017-16678 | Medium | 2017-12-12 | Not applicable | No public exploit | Server Side Request Forgery (SSRF) vulnerability in SAP NetWeaver Knowledge Management Configuration Service, EPBC and EPBC2 from 7.00 to 7.02; KMC-BC 7.30, 7.31, 7.40 and 7.50, that allows an attacker to manipulate the vulnerable application to send crafted requests on behalf of the application. |
| CVE-2017-2097 | High | 2017-04-28 | Not applicable | No public exploit | Cross-site request forgery (CSRF) vulnerability in Knowledge versions prior to v1.7.0 allows remote attackers to hijack the authentication of administrators via unspecified vectors. |
| CVE-2016-8344 | Low | 2017-02-13 | Not applicable | No public exploit | An issue was discovered in Honeywell Experion Process Knowledge System (PKS) platform: Experion PKS, Release 3xx and prior, Experion PKS, Release 400, Experion PKS, Release 410, Experion PKS, Release 430, and Experion PKS, Release 431. Experion PKS does not properly validate input. By sending a specially crafted packet, an attacker could cause the process to terminate. A successful exploit would prevent firmware uploads to the Series-C devices. |
| CVE-2013-4754 | Low | 2014-12-26 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in Owl Intranet Knowledgebase 1.10 allow remote authenticated users to inject arbitrary web script or HTML via (1) the Search field to browse.php or (2) the Title field to prefs.php. |
| CVE-2014-7418 | Medium | 2014-10-19 | Not applicable | No public exploit | The BBC Knowledge Magazine (aka com.magzter.bbcknowledge) application 3.01 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. |
| CVE-2014-2737 | High | 2014-04-22 | Not applicable | No public exploit | SQL injection vulnerability in the get_active_session function in the KTAPI_UserSession class in webservice/clienttools/services/mdownload.php in KnowledgeTree 3.7.0.2 and earlier allows remote attackers to execute arbitrary SQL commands via the u parameter, related to the getFileName function. |
| CVE-2013-3616 | Medium | 2013-09-24 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the KnowledgeView Editorial and Management application allows remote attackers to inject arbitrary web script or HTML via the username parameter. |
| CVE-2012-0988 | Medium | 2012-09-20 | Not applicable | Working exploit published | Multiple cross-site scripting (XSS) vulnerabilities in config/dmsDefaults.php in KnowledgeTree 3.7.0.2 and possibly earlier allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) login.php, (2) admin.php, or (3) preferences.php. |
| CVE-2009-4192 | Medium | 2009-12-03 | Not applicable | Working exploit published | Directory traversal vulnerability in dialog/file_manager.php in Interspire Knowledge Manager 5 allows remote attackers to read arbitrary files via a .. (dot dot) in the p parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. |
| CVE-2008-5858 | Medium | 2009-01-06 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in KnowledgeTree before 3.5.4a allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different issue than CVE-2007-4281. |
| CVE-2008-5857 | Medium | 2009-01-06 | Not applicable | No public exploit | The DropDocuments plugin in KnowledgeTree before 3.5.4a allows remote authenticated users to gain administrative privileges via a certain sequence of "browse documents" and dashboard requests. |
| CVE-2008-5264 | Medium | 2008-11-28 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in searcher.exe in Tornado Knowledge Retrieval System 4.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the p parameter in a root action. |
| CVE-2008-5088 | High | 2008-11-14 | Not applicable | Working exploit published | Multiple SQL injection vulnerabilities in PHPKB Knowledge Base Software 1.5 Professional allow remote attackers to execute arbitrary SQL commands via the ID parameter to (1) email.php and (2) question.php, a different vector than CVE-2008-1909. |
| CVE-2008-3555 | Medium | 2008-08-08 | Not applicable | Working exploit published | Directory traversal vulnerability in index.php in (1) WSN Forum 4.1.43 and earlier, (2) Gallery 4.1.30 and earlier, (3) Knowledge Base (WSNKB) 4.1.36 and earlier, (4) Links 4.1.44 and earlier, and possibly (5) Classifieds before 4.1.30 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the TID parameter, as demonstrated by uploading a .jpg file containing PHP sequences. |
| CVE-2008-3359 | High | 2008-07-29 | Not applicable | No public exploit | SQL injection vulnerability in register.php in Steve Bourgeois and Chris Vincent Owl Intranet Knowledgebase 0.95 and earlier allows remote attackers to execute arbitrary SQL commands via the username parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. |
| CVE-2008-3100 | Medium | 2008-07-29 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in lib/owl.lib.php in Steve Bourgeois and Chris Vincent Owl Intranet Knowledgebase 0.95 and earlier allows remote attackers to inject arbitrary web script or HTML via the username parameter in a getpasswd action to register.php. |
| CVE-2008-1909 | High | 2008-04-22 | Not applicable | Working exploit published | SQL injection vulnerability in comment.php in PHP Knowledge Base (PHPKB) 1.5 and 2.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter. |
| CVE-2008-1727 | High | 2008-04-11 | Not applicable | Working exploit published | KnowledgeQuest 2.5 and 2.6 does not require authentication for access to admincheck.php, which allows remote attackers to create arbitrary admin accounts. |
| CVE-2008-1726 | Medium | 2008-04-11 | Not applicable | Working exploit published | Multiple SQL injection vulnerabilities in KnowledgeQuest 2.6, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) kqid parameter to (a) articletext.php and (b) articletextonly.php and the (2) username parameter to (c) logincheck.php. |
| CVE-2008-1223 | High | 2008-03-10 | Not applicable | No public exploit | Unspecified vulnerability in Dokeos 1.8.4 before SP3 allows attackers to execute arbitrary code via unspecified vectors. |
| CVE-2008-1222 | Medium | 2008-03-10 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in Dokeos 1.8.4 before SP3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2007-6574 | Medium | 2007-12-28 | Not applicable | Working exploit published | Multiple cross-site scripting (XSS) vulnerabilities in Dokeos 1.8.4 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the origin parameter to work/work.php in a display_upload_form action, or the forum parameter to (2) forum/viewforum.php or (3) forum/viewthread.php. |
| CVE-2007-2889 | High | 2007-05-30 | Not applicable | Working exploit published | SQL injection vulnerability in tracking/courseLog.php in Dokeos 1.6.5 and earlier allows remote attackers to execute arbitrary SQL commands via the scormcontopen parameter. |
| CVE-2007-2849 | High | 2007-05-24 | Not applicable | No public exploit | KnowledgeTree Document Management (aka KnowledgeTree Open Source) before STABLE 3.3.7 does not require a password for an unregistered user, when the user exists in Active Directory, which allows remote attackers to log onto KTDMS without the intended authorization check. |
| CVE-2007-1039 | High | 2007-02-21 | Not applicable | No public exploit | Unspecified vulnerability in Peanut Knowledge Base (PeanutKB) 0.0.3 and earlier has unknown impact and attack vectors. |
| CVE-2006-5919 | High | 2006-11-15 | Not applicable | Working exploit published | PHP remote file inclusion vulnerability in admin/e_data/visEdit_control.class.php in ActiveCampaign KnowledgeBuilder 2.2 allows remote attackers to execute arbitrary PHP code via a URL in the visEdit_root parameter, a different vector than CVE-2003-1131. |
| CVE-2006-5496 | Medium | 2006-10-25 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in Timothy Claason KnowledgeBank 1.01 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters to (1) index.php, (2) addknowledge.php, and (3) addscreenshot.php. |
| CVE-2006-4844 | Medium | 2006-09-19 | Not applicable | Working exploit published | PHP remote file inclusion vulnerability in inc/claro_init_local.inc.php in Claroline 1.7.7 and earlier, as used in Dokeos and possibly other products, allows remote attackers to execute arbitrary PHP code via a URL in the extAuthSource[newUser] parameter. |
| CVE-2006-2886 | Medium | 2006-06-07 | Not applicable | No public exploit | view.php in KnowledgeTree Open Source 3.0.3 and earlier allows remote attackers to obtain the full installation path via a crafted fDocumentId parameter, which displays the path in the resulting error message. NOTE: this might be resultant from another vulnerability, since this vector also produces XSS. |
| CVE-2006-2885 | Medium | 2006-06-07 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in KnowledgeTree Open Source 3.0.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) fDocumentId parameter in view.php and the (2) fSearchableText parameter in /search/simpleSearch.php. |
| CVE-2006-2443 | Medium | 2006-05-18 | Not applicable | No public exploit | The Debian package of knowledgetree 2.0.7 creates environment.php with world-readable permissions, which allows local users to obtain sensitive information such as the username and password for the KnowledgeTree database. |
| CVE-2006-2285 | Medium | 2006-05-10 | Not applicable | Working exploit published | PHP remote file inclusion vulnerability in authldap.php in Dokeos 1.6.4 allows remote attackers to execute arbitrary PHP code via a URL in the includePath parameter. |
| CVE-2006-2184 | Medium | 2006-05-04 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in search.php in PHPKB Knowledge Base allows remote attackers to inject arbitrary web script or HTML via the searchkeyword parameter. NOTE: the issue was originally disputed by the vendor, but on 20060519, the vendor notified CVE that "We have fixed all the mentioned issues and now the search section of PHPKB script is free from any XSS issues." |
| CVE-2006-1438 | Medium | 2006-04-03 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in Andy's PHP Knowledgebase (aphpkb) 0.57 allow remote attackers to inject arbitrary web script or HTML via the (1) keyword_list parameter to (a) index.php; (2) title, (3) article, (4) author, and (5) keywords parameters to (b) submit_article.php; and (6) Question, (7) Name, and (8) Email parameters to (c) submit_question.php. |
| CVE-2006-1294 | High | 2006-03-19 | Not applicable | No public exploit | PHP remote file include vulnerability in PageController.php in KnowledgebasePublisher 1.2 allows remote attackers to include and execute arbitrary PHP code via a URL in the dir parameter. |
| CVE-2006-0970 | High | 2006-03-03 | Not applicable | No public exploit | PHP remote file inclusion vulnerability in index.php in one or more ActiveCampaign products, possibly SupportTrio, allows remote attackers to include and execute arbitrary files via the page parameter. |
| CVE-2005-4658 | Medium | 2005-12-31 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in ASP-Programmers.com ASPKnowledgebase allow remote attackers to inject arbitrary web script or HTML via unknown attack vectors in the administrative interface. |
| CVE-2005-3653 | High | 2005-12-31 | Not applicable | No public exploit | Heap-based buffer overflow in the iGateway service for various Computer Associates (CA) iTechnology products, in iTechnology iGateway before 4.0.051230, allows remote attackers to execute arbitrary code via an HTTP request with a negative Content-Length field. |
| CVE-2005-4047 | Medium | 2005-12-07 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in kb.asp in IISWorks ASPKnowledgeBase 2.0 allows remote attackers to inject arbitrary web script or HTML via the a parameter. |
| CVE-2005-3942 | High | 2005-12-01 | Not applicable | Working exploit published | SQL injection vulnerability in knowledgebase-control.php in Orca Knowledgebase 2.1b and earlier allows remote attackers to execute arbitrary SQL commands via the qid parameter. |
| CVE-2005-3939 | High | 2005-12-01 | Not applicable | Working exploit published | Multiple SQL injection vulnerabilities in WSN Knowledge Base 1.2.0 and earler allow remote attackers to execute arbitrary SQL commands via the (1) catid, (2) perpage, (3) ascdesc, and (4) orderlinks in a displaycat action in (a) index.php; and the (5) id parameter in (b) comments.php and (c) memberlist.php. |
| CVE-2005-3882 | High | 2005-11-29 | Not applicable | Working exploit published | SQL injection vulnerability in answer.php in FAQSystems FAQRing Knowledge Base Software 3.0 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter. |
| CVE-2005-3881 | High | 2005-11-29 | Not applicable | No public exploit | SQL injection vulnerability in search.php in AtlantisFAQ Knowledge Base Software 2.03 and earlier allows remote attackers to execute arbitrary SQL commands via the searchStr parameter. |
| CVE-2005-3829 | High | 2005-11-26 | Not applicable | No public exploit | index.php in ActiveCampaign KnowledgeBuilder 2.4 and earlier allows remote attackers to cause a denial of service (CPU consumption) via an invalid category parameter, which causes a large number of SQL queries to be processed. |
| CVE-2005-3828 | High | 2005-11-26 | Not applicable | No public exploit | SQL injection vulnerability in index.php in ActiveCampaign KnowledgeBuilder 2.4 and earlier allows remote attackers to execute arbitrary SQL commands via the article parameter. |
| CVE-2005-3596 | High | 2005-11-16 | Not applicable | No public exploit | SQL injection vulnerability in ASPKnowledgebase allows remote attackers to execute arbitrary SQL commands and bypass authentication via the (1) username and (2) password fields in adminlogin.asp. |
| CVE-2003-1131 | High | 2003-12-31 | Not applicable | Working exploit published | PHP remote file inclusion vulnerability in index.php in KnowledgeBuilder, referred to as KnowledgeBase, allows remote attackers to execute arbitrary PHP code by modifying the page parameter to reference a URL on a remote web server that contains the code. |