CVE-2004-2715

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

edituser.php3 in PHPMyChat 0.14.5 allow remote attackers to bypass authentication and gain administrative privileges by setting the do_not_login parameter to false.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-287

Affected software

No affected versions have been published.

Timeline

Published
Dec 31, 2004
Last modified
Jun 16, 2026
NVD status
Modified

Related CVEs from 2004

CVE-2004-27167.5Multiple SQL injection vulnerabilities in usersL.php3 in PHPMyChat 0.14.5 allow remote attackers to execute arbitrary SQL commands via the (CVE-2004-27172.6Multiple directory traversal vulnerabilities in admin.php3 in PHPMyChat 0.14.5 allow remote attackers with administrative privileges to readCVE-2004-27184.3PHPMyChat 0.14.5 does not remove or protect setup.php3 after installation, which allows attackers to obtain sensitive information including CVE-2004-27196.8Buffer overflow in the UrlToLocal function in PunyLib.dll of Foxmail 5.0.300 allows remote attackers to execute arbitrary code via a mail meCVE-2004-27204.3Cross-site scripting (XSS) vulnerability in register.asp in Snitz Forums 2000 3.4.04 and earlier allows remote attackers to inject arbitraryCVE-2004-27214.3The CheckGroup function in openSkat VTMF before 2.1 generates public key pairs in which the "p" variable might not be prime, which allows reCVE-2004-27222.1Nessus 2.0.10a stores account passwords in plaintext in .nessusrc files, which allows local users to obtain passwords. NOTE: the original rCVE-2004-27232.1NessusWX 1.4.4 stores account passwords in plaintext in .session files, which allows local users to obtain passwords.CVE-2004-27247.1LionMax Software Chat Anywhere 2.72a allows remote attackers to cause a denial of service (server crash and client CPU consumption) via a usCVE-2004-27254.3Multiple cross-site scripting (XSS) vulnerabilities in Aztek Forum 4.0 allow remote attackers to inject arbitrary web script or HTML via (1)CVE-2004-27265.0HTTPMail service in MailEnable Professional 1.18 does not properly handle arguments to the Authorization header, which allows remote attackeCVE-2004-27274.3Buffer overflow in MEHTTPS (HTTPMail) of MailEnable Professional 1.5 through 1.7 allows remote attackers to cause a denial of service (appli