Mambo vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2008-0721 SQL injection vulnerability in index.php in the Sermon (com_sermon) 0.2 component for Mambo allows remote attackers to execute arbitrary SQL commands via the giHigh 7.5 · Feb 11, 2008
• CVE-2007-4505 SQL injection vulnerability in index.php in the RemoSitory component (com_remository) for Mambo allows remote attackers to execute arbitrary SQL commands via thHigh 7.5 · Aug 23, 2007
• CVE-2007-4456 SQL injection vulnerability in index.php in the SimpleFAQ (com_simplefaq) 2.11 component for Mambo allows remote attackers to execute arbitrary SQL commands viaHigh 7.5 · Aug 21, 2007
• CVE-2007-4203 Session fixation vulnerability in Mambo 4.6.2 CMS allows remote attackers to hijack web sessions by setting the Cookie parameter.High 9.3 · Aug 7, 2007
• CVE-2006-7202 The dofreePDF function in includes/pdf.php in Mambo 4.6.1 does not properly check access rights for database content, which allows remote attackers to read certHigh 7.8 · May 9, 2007
• CVE-2006-7150 Multiple SQL injection vulnerabilities in Mambo 4.6.x allow remote attackers to execute arbitrary SQL commands via the mcname parameter to (1) moscomment.php anHigh 7.5 · Mar 7, 2007
• CVE-2006-7104 PHP remote file inclusion vulnerability in htmltemplate.php in the Chad Auld MOStlyContent Editor (MOStlyCE) as created on May 2006, a component for Mambo 4.5.4High 7.5 · Mar 3, 2007
• CVE-2006-6634 Multiple PHP remote file inclusion vulnerabilities in the ExtCalThai (com_extcalendar) 0.9.1 and earlier component for Mambo allow remote attackers to execute aHigh 7.5 · Dec 18, 2006
• CVE-2006-4375 PHP remote file inclusion vulnerability in contxtd.class.php in the Contacts XTD (ContXTD) component for Mambo (com_contxtd) allows remote attackers to execute High 7.5 · Aug 26, 2006
• CVE-2006-4296 PHP remote file inclusion vulnerability in classes/Tar.php in bigAPE-Backup component (com_babackup) for Mambo 1.1 allows remote attackers to include arbitrary High 7.5 · Aug 22, 2006
• CVE-2006-4286 PHP remote file inclusion vulnerability in contentpublisher.php in the contentpublisher component (com_contentpublisher) for Mambo allows remote attackers to exHigh 7.5 · Aug 22, 2006
• CVE-2006-4275 PHP remote file inclusion vulnerability in catalogshop.php in the CatalogShop component for Mambo (com_catalogshop) allows remote attackers to execute arbitraryHigh 7.5 · Aug 21, 2006
• CVE-2006-4280 PHP remote file inclusion vulnerability in anjel.index.php in ANJEL (formerly MaMML) Component (com_anjel) for Mambo allows remote attackers to execute arbitrarHigh 7.5 · Aug 21, 2006
• CVE-2006-4264 Multiple PHP remote file inclusion vulnerabilities in the lmtg_myhomepage Component (com_lmtg_myhomepage) for Mambo allow remote attackers to execute arbitrary Critical 9.8 · Aug 21, 2006
• CVE-2006-3981 PHP remote file inclusion vulnerability in about.mgm.php in Mambo Gallery Manager (MGM) 0.95r2 and earlier for Mambo 4.5 allows remote attackers to execute arbiHigh 7.5 · Aug 4, 2006
• CVE-2006-3962 PHP remote file inclusion vulnerability in administrator/components/com_bayesiannaivefilter/lang.php in the bayesiannaivefilter component (com_bayesiannaivefiltHigh 7.5 · Aug 1, 2006
• CVE-2006-3843 PHP remote file inclusion vulnerability in com_calendar.php in Calendar Mambo Module 1.5.7 and earlier allows remote attackers to execute arbitrary PHP code viaHigh 7.5 · Jul 25, 2006
• CVE-2006-3736 PHP remote file inclusion vulnerability in core/videodb.class.xml.php in the VideoDB component for Mambo 0.3 and earlier allows remote attackers to execute arbiHigh 7.5 · Jul 21, 2006
• CVE-2006-3262 SQL injection vulnerability in the Weblinks module (weblinks.php) in Mambo 4.6rc1 and earlier allows remote attackers to execute arbitrary SQL commands via the High 7.5 · Jun 27, 2006
• CVE-2006-3263 SQL injection vulnerability in the Weblinks module (weblinks.php) in Mambo 4.6rc1 and earlier allows remote attackers to execute arbitrary SQL commands via the High 7.5 · Jun 27, 2006
• CVE-2006-1794 SQL injection vulnerability in Mambo 4.5.3, 4.5.3h, and possibly earlier versions allows remote attackers to execute arbitrary SQL commands via (1) the $usernamHigh 7.6 · Apr 17, 2006
• CVE-2005-4156 Unspecified vulnerability in Mambo 4.5 (1.0.0) through 4.5 (1.0.9), with magic_quotes_gpc disabled, allows remote attackers to read arbitrary files and possiblyHigh 9.4 · Dec 10, 2005
• CVE-2005-2002 SQL injection vulnerability in content.php in Mambo 4.5.2.2 and earlier allows remote attackers to execute arbitrary SQL commands via the user_rating parameter.High 7.5 · Jun 15, 2005
• CVE-2005-0512 PHP remote file inclusion vulnerability in Tar.php in Mambo 4.5.2 allows remote attackers to execute arbitrary PHP code by modifying the mosConfig_absolute_pathHigh 7.5 · Feb 21, 2005
• CVE-2004-2143 SQL injection vulnerability in the ReMOSitory Server add-on module to Mambo Portal 4.5.1 (1.09) and earlier allows remote attackers to execute arbitrary SQL comHigh 7.5 · Dec 31, 2004