Overview 80 matches · 0 in Waratek scope · 0 protected · 1 exploited · 0 CISA KEV · 9 public PoC · 1 EPSS ≥ 0.5
80matches
0in Waratek scope0.0%
0protected0.0%
1exploited1.2%
0CISA KEV0.0%
9public PoC11.2%
1EPSS ≥ 0.51.2%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
0
0.0%
Not applicable
80
100.0%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
80
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
1
1.2%
Working exploit published
8
10.0%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
71
88.8%
split by
peak 37 / year
20051
Not applicable1
High1
not blocked1
No public exploit1
20068
Not applicable8
High8
not blocked8
Working exploit published2
No public exploit6
20074
Not applicable4
High4
not blocked4
Working exploit published2
No public exploit2
20080
20091
Not applicable1
High1
not blocked1
Working exploit published1
20100
20110
20120
20130
20140
20150
20160
20173
Not applicable3
High3
not blocked3
Working exploit published2
No public exploit1
20184
Not applicable4
High4
not blocked4
No public exploit4
20191
Not applicable1
High1
not blocked1
No public exploit1
20201
Not applicable1
High1
not blocked1
No public exploit1
20217
Not applicable7
High7
not blocked7
Exploited1
No public exploit6
20225
Not applicable5
High5
not blocked5
Working exploit published1
No public exploit4
202337
Not applicable37
High37
not blocked37
No public exploit37
20245
Not applicable5
High5
not blocked5
No public exploit5
20252
Not applicable2
High2
not blocked2
No public exploit2
20261
Not applicable1
High1
not blocked1
No public exploit1
20062008201020122014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-53410 | High | 2026-07-16 | Not applicable | No public exploit | A time-of-check to time-of-use (TOCTOU) race condition in the installation and uninstallation process of certain Zoom Clients for Windows could allow an authenticated local user to escalate privileges. |
| CVE-2025-3431 | High | 2025-04-08 | Not applicable | No public exploit | The ZoomSounds - WordPress Wave Audio Player with Playlist plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 6.91 via the 'dzsap_download' action. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. |
| CVE-2024-13776 | High | 2025-04-05 | Not applicable | No public exploit | The ZoomSounds - WordPress Wave Audio Player with Playlist plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the 'dzsap_delete_notice' AJAX action in all versions up to, and including, 6.91. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update option values to 'seen' on the WordPress site. This can be leveraged to update an option that would create an error on the site and deny service to legitimate users or be used to set some values to true such as registration. There are several other functions also vulnerable to missing authorization. |
| CVE-2022-27540 | High | 2024-06-28 | Not applicable | No public exploit | A potential Time-of-Check to Time-of Use (TOCTOU) vulnerability has been identified in the HP BIOS for certain HP PC products, which might allow arbitrary code execution, denial of service, and information disclosure. HP is releasing BIOS updates to mitigate the potential vulnerability. |
| CVE-2024-24694 | High | 2024-04-09 | Not applicable | No public exploit | Improper privilege management in the installer for Zoom Desktop Client for Windows before version 5.17.10 may allow an authenticated user to conduct an escalation of privilege via local access. |
| CVE-2024-24697 | High | 2024-02-14 | Not applicable | No public exploit | Untrusted search path in some Zoom 32 bit Windows clients may allow an authenticated user to conduct an escalation of privilege via local access. |
| CVE-2024-22162 | High | 2024-01-31 | Not applicable | No public exploit | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPZOOM WPZOOM Shortcodes allows Reflected XSS.This issue affects WPZOOM Shortcodes: from n/a through 1.0.3. |
| CVE-2023-49647 | High | 2024-01-12 | Not applicable | No public exploit | Improper access control in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom SDKs for Windows before version 5.16.10 may allow an authenticated user to conduct an escalation of privilege via local access. |
| CVE-2023-43586 | High | 2023-12-13 | Not applicable | No public exploit | Path traversal in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom SDKs for Windows may allow an authenticated user to conduct an escalation of privilege via network access. |
| CVE-2023-43585 | High | 2023-12-13 | Not applicable | No public exploit | Improper access control in Zoom Mobile App for iOS and Zoom SDKs for iOS before version 5.16.5 may allow an authenticated user to conduct a disclosure of information via network access. |
| CVE-2023-43582 | High | 2023-11-15 | Not applicable | No public exploit | Improper authorization in some Zoom clients may allow an authorized user to conduct an escalation of privilege via network access. |
| CVE-2023-39206 | High | 2023-11-14 | Not applicable | No public exploit | Buffer overflow in some Zoom clients may allow an unauthenticated user to conduct a denial of service via network access. |
| CVE-2023-39204 | High | 2023-11-14 | Not applicable | No public exploit | Buffer overflow in some Zoom clients may allow an unauthenticated user to conduct a denial of service via network access. |
| CVE-2023-39203 | High | 2023-11-14 | Not applicable | No public exploit | Uncontrolled resource consumption in Zoom Team Chat for Zoom Desktop Client for Windows and Zoom VDI Client may allow an unauthenticated user to conduct a disclosure of information via network access. |
| CVE-2023-39215 | High | 2023-09-12 | Not applicable | No public exploit | Improper authentication in Zoom clients may allow an authenticated user to conduct a denial of service via network access. |
| CVE-2023-39208 | High | 2023-09-12 | Not applicable | No public exploit | Improper input validation in Zoom Desktop Client for Linux before version 5.15.10 may allow an unauthenticated user to conduct a denial of service via network access. |
| CVE-2023-39201 | High | 2023-09-12 | Not applicable | No public exploit | Untrusted search path in CleanZoom before file date 07/24/2023 may allow a privileged user to conduct an escalation of privilege via local access. |
| CVE-2023-39214 | High | 2023-08-08 | Not applicable | No public exploit | Exposure of sensitive information in Zoom Client SDK's before 5.15.5 may allow an authenticated user to enable a denial of service via network access. |
| CVE-2023-39211 | High | 2023-08-08 | Not applicable | No public exploit | Improper privilege management in Zoom Desktop Client for Windows and Zoom Rooms for Windows before 5.15.5 may allow an authenticated user to enable an information disclosure via local access. |
| CVE-2023-36541 | High | 2023-08-08 | Not applicable | No public exploit | Insufficient verification of data authenticity in Zoom Desktop Client for Windows before 5.14.5 may allow an authenticated user to enable an escalation of privilege via network access. |
| CVE-2023-36540 | High | 2023-08-08 | Not applicable | No public exploit | Untrusted search path in the installer for Zoom Desktop Client for Windows before 5.14.5 may allow an authenticated user to enable an escalation of privilege via local access. |
| CVE-2023-36535 | High | 2023-08-08 | Not applicable | No public exploit | Client-side enforcement of server-side security in Zoom clients before 5.14.10 may allow an authenticated user to enable information disclosure via network access. |
| CVE-2023-36532 | High | 2023-08-08 | Not applicable | No public exploit | Buffer overflow in Zoom Clients before 5.14.5 may allow an unauthenticated user to enable a denial of service via network access. |
| CVE-2023-34116 | High | 2023-07-11 | Not applicable | No public exploit | Improper input validation in the Zoom Desktop Client for Windows before version 5.15.0 may allow an unauthorized user to enable an escalation of privilege via network access. |
| CVE-2023-36539 | High | 2023-06-30 | Not applicable | No public exploit | Exposure of information intended to be encrypted by some Zoom clients may lead to disclosure of sensitive information. |
| CVE-2023-34121 | High | 2023-06-13 | Not applicable | No public exploit | Improper input validation in the Zoom for Windows, Zoom Rooms, Zoom VDI Windows Meeting clients before 5.14.0 may allow an authenticated user to potentially enable an escalation of privilege via network access. |
| CVE-2023-34114 | High | 2023-06-13 | Not applicable | No public exploit | Exposure of resource to wrong sphere in Zoom for Windows and Zoom for MacOS clients before 5.14.10 may allow an authenticated user to potentially enable information disclosure via network access. |
| CVE-2023-28602 | High | 2023-06-13 | Not applicable | No public exploit | Zoom for Windows clients prior to 5.13.5 contain an improper verification of cryptographic signature vulnerability. A malicious user may potentially downgrade Zoom Client components to previous versions. |
| CVE-2023-28601 | High | 2023-06-13 | Not applicable | No public exploit | Zoom for Windows clients prior to 5.14.0 contain an improper restriction of operations within the bounds of a memory buffer vulnerability. A malicious user may alter protected Zoom Client memory buffer potentially causing integrity issues within the Zoom Client. |
| CVE-2023-28598 | High | 2023-06-13 | Not applicable | No public exploit | Zoom for Linux clients prior to 5.13.10 contain an HTML injection vulnerability. If a victim starts a chat with a malicious user it could result in a Zoom application crash. |
| CVE-2022-31639 | High | 2023-06-13 | Not applicable | No public exploit | Potential time-of-check to time-of-use (TOCTOU) vulnerabilities have been identified in the BIOS for certain HP PC products, which might allow arbitrary code execution, escalation of privilege, denial of service, and information disclosure. |
| CVE-2022-31638 | High | 2023-06-13 | Not applicable | No public exploit | Potential time-of-check to time-of-use (TOCTOU) vulnerabilities have been identified in the BIOS for certain HP PC products, which might allow arbitrary code execution, escalation of privilege, denial of service, and information disclosure. |
| CVE-2022-31637 | High | 2023-06-13 | Not applicable | No public exploit | Potential time-of-check to time-of-use (TOCTOU) vulnerabilities have been identified in the BIOS for certain HP PC products, which might allow arbitrary code execution, escalation of privilege, denial of service, and information disclosure. |
| CVE-2022-31636 | High | 2023-06-13 | Not applicable | No public exploit | Potential time-of-check to time-of-use (TOCTOU) vulnerabilities have been identified in the BIOS for certain HP PC products, which might allow arbitrary code execution, escalation of privilege, denial of service, and information disclosure. |
| CVE-2022-31635 | High | 2023-06-13 | Not applicable | No public exploit | Potential time-of-check to time-of-use (TOCTOU) vulnerabilities have been identified in the BIOS for certain HP PC products, which might allow arbitrary code execution, escalation of privilege, denial of service, and information disclosure. |
| CVE-2022-43778 | High | 2023-06-12 | Not applicable | No public exploit | Potential Time-of-Check to Time-of Use (TOCTOU) vulnerabilities have been identified in the HP BIOS for certain HP PC products which may allow arbitrary code execution, denial of service, and information disclosure. |
| CVE-2022-43777 | High | 2023-06-12 | Not applicable | No public exploit | Potential Time-of-Check to Time-of Use (TOCTOU) vulnerabilities have been identified in the HP BIOS for certain HP PC products which may allow arbitrary code execution, denial of service, and information disclosure. |
| CVE-2022-27541 | High | 2023-06-12 | Not applicable | No public exploit | Potential Time-of-Check to Time-of Use (TOCTOU) vulnerabilities have been identified in the HP BIOS for certain HP PC products which may allow arbitrary code execution, denial of service, and information disclosure. |
| CVE-2022-27539 | High | 2023-06-12 | Not applicable | No public exploit | Potential Time-of-Check to Time-of Use (TOCTOU) vulnerabilities have been identified in the HP BIOS for certain HP PC products which may allow arbitrary code execution, denial of service, and information disclosure. |
| CVE-2023-28597 | High | 2023-03-27 | Not applicable | No public exploit | Zoom clients prior to 5.13.5 contain an improper trust boundary implementation vulnerability. If a victim saves a local recording to an SMB location and later opens it using a link from Zoom’s web portal, an attacker positioned on an adjacent network to the victim client could set up a malicious SMB server to respond to client requests, causing the client to execute attacker controlled executables. This could result in an attacker gaining access to a user's device and data, and remote code execution. |
| CVE-2023-22882 | High | 2023-03-16 | Not applicable | No public exploit | Zoom clients before version 5.13.5 contain a STUN parsing vulnerability. A malicious actor could send specially crafted UDP traffic to a victim Zoom client to remotely cause the client to crash, causing a denial of service. |
| CVE-2023-22881 | High | 2023-03-16 | Not applicable | No public exploit | Zoom clients before version 5.13.5 contain a STUN parsing vulnerability. A malicious actor could send specially crafted UDP traffic to a victim Zoom client to remotely cause the client to crash, causing a denial of service. |
| CVE-2023-22880 | High | 2023-03-16 | Not applicable | No public exploit | Zoom for Windows clients before version 5.13.3, Zoom Rooms for Windows clients before version 5.13.5 and Zoom VDI for Windows clients before 5.13.1 contain an information disclosure vulnerability. A recent update to the Microsoft Edge WebView2 runtime used by the affected Zoom clients, transmitted text to Microsoft’s online Spellcheck service instead of the local Windows Spellcheck. Updating Zoom remediates this vulnerability by disabling the feature. Updating Microsoft Edge WebView2 Runtime to at least version 109.0.1481.0 and restarting Zoom remediates this vulnerability by updating Microsoft’s telemetry behavior. |
| CVE-2021-3439 | High | 2023-02-01 | Not applicable | No public exploit | HP has identified a potential vulnerability in BIOS firmware of some Workstation products. Firmware updates are being released to mitigate these potential vulnerabilities. |
| CVE-2022-36928 | High | 2023-01-09 | Not applicable | No public exploit | Zoom for Android clients before version 5.13.0 contain a path traversal vulnerability. A third party app could exploit this vulnerability to read and write to the Zoom application data directory. |
| CVE-2022-28759 | High | 2022-10-14 | Not applicable | No public exploit | Zoom On-Premise Meeting Connector MMR before version 4.8.20220815.130 contains an improper access control vulnerability. As a result, a malicious actor could obtain the audio and video feed of a meeting they were not authorized to join and cause other meeting disruptions. |
| CVE-2022-28758 | High | 2022-09-16 | Not applicable | No public exploit | Zoom On-Premise Meeting Connector MMR before version 4.8.20220815.130 contains an improper access control vulnerability. As a result, a malicious actor could obtain the audio and video feed of a meeting they were not authorized to join and cause other meeting disruptions. |
| CVE-2021-40150 | High | 2022-07-17 | Not applicable | Working exploit published | The web server of the E1 Zoom camera through 3.0.0.716 discloses its configuration via the /conf/ directory that is mapped to a publicly accessible path. In this way an attacker can download the entire NGINX/FastCGI configurations by querying the /conf/nginx.conf or /conf/fastcgi.conf URI. |
| CVE-2022-22783 | High | 2022-04-28 | Not applicable | No public exploit | A vulnerability in Zoom On-Premise Meeting Connector Controller version 4.8.102.20220310 and On-Premise Meeting Connector MMR version 4.8.102.20220310 exposes process memory fragments to connected clients, which could be observed by a passive attacker. |
| CVE-2022-22782 | High | 2022-04-28 | Not applicable | No public exploit | The Zoom Client for Meetings for Windows prior to version 5.9.7, Zoom Rooms for Conference Room for Windows prior to version 5.10.0, Zoom Plugins for Microsoft Outlook for Windows prior to version 5.10.3, and Zoom VDI Windows Meeting Clients prior to version 5.9.6; was susceptible to a local privilege escalation issue during the installer repair operation. A malicious actor could utilize this to potentially delete system level files or folders, causing integrity or availability issues on the user’s host machine. |
| CVE-2021-34424 | High | 2021-11-24 | Not applicable | No public exploit | A vulnerability was discovered in the Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows) before version 5.8.4, Zoom Client for Meetings for Blackberry (for Android and iOS) before version 5.8.1, Zoom Client for Meetings for intune (for Android and iOS) before version 5.8.4, Zoom Client for Meetings for Chrome OS before version 5.0.1, Zoom Rooms for Conference Room (for Android, AndroidBali, macOS, and Windows) before version 5.8.3, Controllers for Zoom Rooms (for Android, iOS, and Windows) before version 5.8.3, Zoom VDI Windows Meeting Client before version 5.8.4, Zoom VDI Azure Virtual Desktop Plugins (for Windows x86 or x64, IGEL x64, Ubuntu x64, HP ThinPro OS x64) before version 5.8.4.21112, Zoom VDI Citrix Plugins (for Windows x86 or x64, Mac Universal Installer & Uninstaller, IGEL x64, eLux RP6 x64, HP ThinPro OS x64, Ubuntu x64, CentOS x 64, Dell ThinOS) before version 5.8.4.21112, Zoom VDI VMware Plugins (for Windows x86 or x64, Mac Universal Installer & Uninstaller, IGEL x64, eLux RP6 x64, HP ThinPro OS x64, Ubuntu x64, CentOS x 64, Dell ThinOS) before version 5.8.4.21112, Zoom Meeting SDK for Android before version 5.7.6.1922, Zoom Meeting SDK for iOS before version 5.7.6.1082, Zoom Meeting SDK for macOS before version 5.7.6.1340, Zoom Meeting SDK for Windows before version 5.7.6.1081, Zoom Video SDK (for Android, iOS, macOS, and Windows) before version 1.1.2, Zoom on-premise Meeting Connector before version 4.8.12.20211115, Zoom on-premise Meeting Connector MMR before version 4.8.12.20211115, Zoom on-premise Recording Connector before version 5.1.0.65.20211116, Zoom on-premise Virtual Room Connector before version 4.4.7266.20211117, Zoom on-premise Virtual Room Connector Load Balancer before version 2.5.5692.20211117, Zoom Hybrid Zproxy before version 1.0.1058.20211116, and Zoom Hybrid MMR before version 4.6.20211116.131_x86-64 which potentially allowed for the exposure of the state of process memory. This issue could be used to potentially gain insight into arbitrary areas of the product's memory. |
| CVE-2021-34420 | High | 2021-11-11 | Not applicable | No public exploit | The Zoom Client for Meetings for Windows installer before version 5.5.4 does not properly verify the signature of files with .msi, .ps1, and .bat extensions. This could lead to a malicious actor installing malicious software on a customer’s computer. |
| CVE-2021-34417 | High | 2021-11-11 | Not applicable | No public exploit | The network proxy page on the web portal for the Zoom On-Premise Meeting Connector Controller before version 4.6.365.20210703, Zoom On-Premise Meeting Connector MMR before version 4.6.365.20210703, Zoom On-Premise Recording Connector before version 3.8.45.20210703, Zoom On-Premise Virtual Room Connector before version 4.4.6868.20210703, and Zoom On-Premise Virtual Room Connector Load Balancer before version 2.5.5496.20210703 fails to validate input sent in requests to set the network proxy password. This could lead to remote command injection by a web portal administrator. |
| CVE-2021-38392 | High | 2021-10-04 | Not applicable | No public exploit | A skilled attacker with physical access to the affected device can gain access to the hard disk drive of the device to change the telemetry region and could use this setting to interrogate or program an implantable device in any region in the world. |
| CVE-2021-34413 | High | 2021-09-27 | Not applicable | No public exploit | All versions of the Zoom Plugin for Microsoft Outlook for MacOS before 5.3.52553.0918 contain a Time-of-check Time-of-use (TOC/TOU) vulnerability during the plugin installation process. This could allow a standard user to write their own malicious application to the plugin directory, allowing the malicious application to execute in a privileged context. |
| CVE-2021-34410 | High | 2021-09-27 | Not applicable | No public exploit | A user-writable application bundle unpacked during the install for all versions of the Zoom Plugin for Microsoft Outlook for Mac before 5.0.25611.0521 allows for privilege escalation to root. |
| CVE-2021-39316 | High | 2021-08-31 | Not applicable | Exploited | The Zoomsounds plugin <= 6.45 for WordPress allows arbitrary files, including sensitive configuration files such as wp-config.php, to be downloaded via the `dzsap_download` action using directory traversal in the `link` parameter. |
| CVE-2020-6110 | High | 2020-06-08 | Not applicable | No public exploit | An exploitable partial path traversal vulnerability exists in the way Zoom Client version 4.6.10 processes messages including shared code snippets. A specially crafted chat message can cause an arbitrary binary planting which could be abused to achieve arbitrary code execution. An attacker needs to send a specially crafted message to a target user or a group to trigger this vulnerability. For the most severe effect, target user interaction is required. |
| CVE-2019-13567 | High | 2019-07-12 | Not applicable | No public exploit | The Zoom Client before 4.4.53932.0709 on macOS allows remote code execution, a different vulnerability than CVE-2019-13450. If the ZoomOpener daemon (aka the hidden web server) is running, but the Zoom Client is not installed or can't be opened, an attacker can remotely execute code with a maliciously crafted launch URL. NOTE: ZoomOpener is removed by the Apple Malware Removal Tool (MRT) if this tool is enabled and has the 2019-07-10 MRTConfigData. |
| CVE-2018-10664 | High | 2018-06-26 | Not applicable | No public exploit | An issue was discovered in the httpd process in multiple models of Axis IP Cameras. There is Memory Corruption. |
| CVE-2018-10663 | High | 2018-06-26 | Not applicable | No public exploit | An issue was discovered in multiple models of Axis IP Cameras. There is an Incorrect Size Calculation. |
| CVE-2018-10659 | High | 2018-06-26 | Not applicable | No public exploit | There was a Memory Corruption issue discovered in multiple models of Axis IP Cameras which allows remote attackers to cause a denial of service (crash) by sending a crafted command which will result in a code path that calls the UND undefined ARM instruction. |
| CVE-2018-10658 | High | 2018-06-26 | Not applicable | No public exploit | There was a Memory Corruption issue discovered in multiple models of Axis IP Cameras which causes a denial of service (crash). The crash arises from code inside libdbus-send.so shared object or similar. |
| CVE-2017-15049 | High | 2017-12-19 | Not applicable | Working exploit published | The ZoomLauncher binary in the Zoom client for Linux before 2.0.115900.1201 does not properly sanitize user input when constructing a shell command, which allows remote attackers to execute arbitrary code by leveraging the zoommtg:// scheme handler. |
| CVE-2017-15048 | High | 2017-12-19 | Not applicable | Working exploit published | Stack-based buffer overflow in the ZoomLauncher binary in the Zoom client for Linux before 2.0.115900.1201 allows remote attackers to execute arbitrary code by leveraging the zoommtg:// scheme handler. |
| CVE-2015-2889 | High | 2017-04-10 | Not applicable | No public exploit | Summer Baby Zoom Wifi Monitor & Internet Viewing System allows remote attackers to gain privileges via manual entry of a Settings URL. |
| CVE-2009-4474 | High | 2009-12-30 | Not applicable | Working exploit published | SQL injection vulnerability in the Mike de Boer zoom (com_zoom) component 2.0 for Mambo allows remote attackers to execute arbitrary SQL commands via the catid parameter to index.php. |
| CVE-2007-6533 | High | 2007-12-27 | Not applicable | Working exploit published | Buffer overflow in Zoom Player 6.00 beta 2 and earlier allows user-assisted remote attackers to execute arbitrary code via an HTTP link to a PLS file in a crafted ZPL file, which causes an overflow in Unicode handling when generating an error message. |
| CVE-2007-3588 | High | 2007-07-05 | Not applicable | No public exploit | SQL injection vulnerability in reply.php in VBZooM 1.12 allows remote attackers to execute arbitrary SQL commands via the UserID parameter to sub-join.php. NOTE: this may be the same as CVE-2006-3691.4. |
| CVE-2007-2920 | High | 2007-06-11 | Not applicable | No public exploit | Multiple stack-based buffer overflows in the Zoomify Viewer ActiveX control in ZActiveX.dll might allow remote attackers to execute arbitrary code via unspecified vectors. |
| CVE-2007-1992 | High | 2007-04-12 | Not applicable | Working exploit published | Multiple PHP remote file inclusion vulnerabilities in the com_zoom 2.5 beta 2 and earlier module for Mambo allow remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter to (1) EXIF_Makernote.php or (2) EXIF.php in classes/iptc/. |
| CVE-2006-3691 | High | 2006-07-21 | Not applicable | No public exploit | Multiple SQL injection vulnerabilities in VBZooM 1.11 and earlier allow remote attackers to execute arbitrary SQL commands via the UserID parameter to (1) ignore-pm.php, (2) sendmail.php, (3) reply.php or (4) sub-join.php. |
| CVE-2006-3239 | High | 2006-06-27 | Not applicable | No public exploit | SQL injection vulnerability in message.php in VBZooM 1.11 and earlier allows remote attackers to execute arbitrary SQL commands via the UserID parameter. |
| CVE-2006-3238 | High | 2006-06-27 | Not applicable | No public exploit | Multiple SQL injection vulnerabilities in VBZooM 1.00 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) MemberID parameter to rank.php, and the (2) QuranID parameter to lng.php. |
| CVE-2006-3142 | High | 2006-06-22 | Not applicable | Working exploit published | SQL injection vulnerability in forum.php in VBZooM 1.11 allows remote attackers to execute arbitrary SQL commands via the MainID parameter. |
| CVE-2006-3056 | High | 2006-06-16 | Not applicable | No public exploit | SQL injection vulnerability in language.php in VBZooM 1.01 allows remote attackers to execute arbitrary SQL commands via the Action parameter. |
| CVE-2006-3055 | High | 2006-06-16 | Not applicable | No public exploit | Multiple SQL injection vulnerabilities in VBZooM 1.02 allow remote attackers to execute arbitrary SQL commands via the (1) QuranID, (2) ShowByQuranID, or (3) Action parameters to meaning.php. |
| CVE-2006-3054 | High | 2006-06-16 | Not applicable | No public exploit | Multiple SQL injection vulnerabilities in VBZooM 1.11 allow remote attackers to execute arbitrary SQL commands via the (1) sobjectID or (2) MAINID parameters to (a) show.php or (3) MainID parameter to (b) subject.php. |
| CVE-2006-1132 | High | 2006-03-10 | Not applicable | Working exploit published | SQL injection vulnerability in show.php in vbzoom 1.11 allow remote attackers to execute arbitrary SQL commands via the MainID parameter. NOTE: the SubjectID vector is already covered by CVE-2005-4729. |
| CVE-2005-4729 | High | 2005-12-31 | Not applicable | No public exploit | SQL injection vulnerability in show.php in VBZooM Forum allows remote attackers to execute arbitrary SQL commands via the SubjectID parameter. |