📦

mdforum

Vendor: maxdev

Login to add this product to WatchStack
Actively Exploited 0 CISA KEV List
PoC / Exploits 1 Code Available
Total RCEs 0 Remote Access
Total CVEs 5 Total Indexed
Avg. EPSS 2.16% Exploit Prob.
Latest CVE CVE-2009-4577 Jan 06

Security Vulnerability Index

Page 1 / 1
7.5 CVSS
CVE-2009-4577

SQL injection vulnerability in the MDForum module 2.x through 2.07 for MAXdev MDPro allows remote attackers to execute arbitrary SQL commands via the c parameter to index.php.

EPSS: 1.17%
9.3 CVSS
CVE-2006-6869
Exploit Found

Directory traversal vulnerability in includes/search/search_mdforum.php in MAXdev MDForum 2.0.1 and earlier, when magic_quotes_gpc is disabled and register_globals is enabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the PNSVlang cookie to error.php, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by error.php.

EPSS: 3.16%