CVE-2001-0088

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

common.inc.php in phpWebLog 0.4.2 does not properly initialize the $CONF array, which inadvertently sets the password to a single character, allowing remote attackers to easily guess the SiteKey and gain administrative privileges to phpWebLog.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://archives.neohapsis.com/archives/bugtraq/2000-12/0025.htmlExploit, Vendor Advisory
http://www.securityfocus.com/bid/2047Exploit, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/5625
http://archives.neohapsis.com/archives/bugtraq/2000-12/0025.htmlExploit, Vendor Advisory
http://www.securityfocus.com/bid/2047Exploit, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/5625

Timeline

Published: Feb 16, 2001
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2001

CVE-2001-00892.6Internet Explorer 5.0 through 5.5 allows remote attackers to read arbitrary files from the client via the INPUT TYPE element in an HTML form CVE-2001-00905.1The Print Templates feature in Internet Explorer 5.5 executes arbitrary custom print templates without prompting the user, which could allow CVE-2001-00912.6The ActiveX control for invoking a scriptlet in Internet Explorer 5.0 through 5.5 renders arbitrary file types instead of HTML, which allows CVE-2001-00922.6A function in Internet Explorer 5.0 through 5.5 does not properly verify the domain of a frame within a browser window, which allows a remot CVE-2001-00937.2Vulnerability in telnetd in FreeBSD 1.5 allows local users to gain root privileges by modifying critical environmental variables that affect CVE-2001-00947.2Buffer overflow in kdc_reply_cipher of libkrb (Kerberos 4 authentication library) in NetBSD 1.5 and FreeBSD 4.2 and earlier, as used in Kerb CVE-2001-00951.2catman in Solaris 2.7 and 2.8 allows local users to overwrite arbitrary files via a symlink attack on the sman_PID temporary file.CVE-2001-00965.0FrontPage Server Extensions (FPSE) in IIS 4.0 and 5.0 allows remote attackers to cause a denial of service via a malformed form, aka the "Ma CVE-2001-00975.0The Web interface for Infinite Interchange 3.6.1 allows remote attackers to cause a denial of service (application crash) via a large POST r CVE-2001-009810.0Buffer overflow in Bea WebLogic Server before 5.1.0 allows remote attackers to execute arbitrary commands via a long URL that begins with a CVE-2001-009910.0bsguest.cgi guestbook script allows remote attackers to execute arbitrary commands via shell metacharacters in the email address.CVE-2001-010010.0bslist.cgi mailing list script allows remote attackers to execute arbitrary commands via shell metacharacters in the email address.