CVE-2003-1423

MediumCVSS 5.0/10Last modified Jun 16, 2026

Description

Petitforum stores the liste.txt data file under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information such as e-mail addresses and encrypted passwords.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:P/I:N/A:N

Weakness enumeration

CWE-264

Affected software

No affected versions have been published.

Timeline

Published
Dec 31, 2003
Last modified
Jun 16, 2026
NVD status
Modified

Related CVEs from 2003

CVE-2003-14246.8message.php in Petitforum does not properly authenticate users, which allows remote attackers to impersonate forum users via a modified connCVE-2003-142510.0guestbook.cgi in cPanel 5.0 allows remote attackers to execute arbitrary commands via the template parameter.CVE-2003-14263.3Openwebmail in cPanel 5.0, when run using suid Perl, adds the directory in the SCRIPT_FILENAME environment variable to Perl's @INC include aCVE-2003-14276.4Directory traversal vulnerability in the web configuration interface in Netgear FM114P 1.4 allows remote attackers to read arbitrary files, CVE-2003-14284.8Gallery 1.3.3 creates directories with insecure permissions, which allows local users to read, modify, or delete photos.CVE-2003-14297.5Buffer overflow in Proxomitron Naoko 4.4 allows remote attackers to execute arbitrary code via a long request.CVE-2003-14305.0Directory traversal vulnerability in Unreal Tournament Server 436 and earlier allows remote attackers to access known files via a ".." (dot CVE-2003-14317.1Buffer overflow in Epic Games Unreal Engine 226f through 436 allows remote attackers to cause a denial of service (crash) via a long host stCVE-2003-143210.0Epic Games Unreal Engine 226f through 436 allows remote attackers to cause a denial of service (CPU consumption or crash) and possibly execuCVE-2003-14334.3Epic Games Unreal Engine 226f through 436 does not validate the challenge key, which allows remote attackers to exhaust the player limit by CVE-2003-14346.8login_ldap 3.1 and 3.2 allows remote attackers to initiate unauthenticated bind requests if (1) bind_anon_dn is on, which allows a bind withCVE-2003-14357.5SQL injection vulnerability in PHP-Nuke 5.6 and 6.0 allows remote attackers to execute arbitrary SQL commands via the days parameter to the
CVE-2003-1423: Medium severity, CVSS 5.0 | Vulnix