CVEvulnerability

CVE-2005-3236

6.8 MEDIUM Published 2005-10-14 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2005-10-14
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P

Description

Multiple SQL injection vulnerabilities in Cyphor 0.19 allow remote attackers to execute arbitrary SQL and obtain administrative access via (1) the fid parameter of newmsg.php, which can enable XSS attacks when the SQL syntax is invalid or (2) the nick parameter of lostpwd.php.

Affected configurations

• cynox cyphor 0.19

References