VendorsReamday Enterprisesmagic_news_plusall versions
Vulnerabilities

Reamday Enterprises Magic News Plus

Ranked by severity, then by exploit likelihood. Click a CVE ID for its full record.

3CVEs
CVE-2007-1141
PHP remote file inclusion vulnerability in preview.php in Magic News Plus 1.0.2 allows remote attackers to execute arbitrary PHP code via a URL in the php_script_path parameter. NOTE: This issue may overlap CVE-2006-0723.
Published 2007-02-27 · Modified
7.51 PoCEPSS 0.058
CVE-2006-0157
settings.php in Reamday Enterprises Magic News Plus 1.0.3 allows remote attackers to change the administrator password via a change action that specifies identical values for the passwd and admin_password parameters, then declares the new password string in the new_passwd and confirm_passwd parameters.
Published 2006-01-10 · Modified
5.01 PoCEPSS 0.023
CVE-2007-1142
Cross-site scripting (XSS) vulnerability in Magic News Plus 1.0.2 allows remote attackers to inject arbitrary web script or HTML via the link_parameters parameter in (1) news.php and (2) n_layouts.php.
Published 2007-02-27 · Modified
4.32 PoCEPSS 0.016