CVE-2005-0743

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

The custom avatar uploading feature (uploader.php) for XOOPS 2.0.9.2 and earlier allows remote attackers to upload arbitrary PHP scripts, whose file extensions are not filtered.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://secunia.com/advisories/14520Patch, Vendor Advisory
http://www.securityfocus.com/archive/1/392626Patch
http://www.securityfocus.com/bid/12754Patch
http://www.xoops.org/modules/news/article.php?storyid=2114Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/19634
http://secunia.com/advisories/14520Patch, Vendor Advisory
http://www.securityfocus.com/archive/1/392626Patch
http://www.securityfocus.com/bid/12754Patch
http://www.xoops.org/modules/news/article.php?storyid=2114Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/19634

Timeline

Published: May 2, 2005
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2005

CVE-2005-074410.0The web GUI for Novell iChain 2.2 and 2.3 SP2 and SP3 allows attackers to hijack sessions and gain administrator privileges by (1) sniffing CVE-2005-07454.6UTStarcom iAN-02EX VoIP Analog Terminal Adaptor (ATA) allows local users to bypass ATA access restrictions by dialing "*#26845#" and causing CVE-2005-07465.0The Mini FTP server in Novell iChain 2.2 and 2.3 SP2 and earlier allows remote unauthenticated attackers to obtain the full path of the serv CVE-2005-07475.0ApplyYourself i-Class allows remote attackers to obtain sensitive information about their own applications by reusing the hidden ID field, a CVE-2005-07487.5PHP remote file inclusion vulnerability in initdb.php for WEBInsta Mailing list manager 1.3d allows remote attackers to execute arbitrary PH CVE-2005-07497.2The load_elf_library in the Linux kernel before 2.6.11.6 allows local users to cause a denial of service (kernel crash) via a crafted ELF li CVE-2005-07507.2The bluez_sock_create function in the Bluetooth stack for Linux kernel 2.4.6 through 2.4.30-rc1 and 2.6 through 2.6.11.5 allows local users CVE-2005-07527.5The Plugin Finder Service (PFS) in Firefox before 1.0.3 allows remote attackers to execute arbitrary code via a javascript: URL in the PLUGI CVE-2005-07537.5Buffer overflow in CVS before 1.11.20 allows remote attackers to execute arbitrary code.CVE-2005-07547.5Kommander in KDE 3.2 through KDE 3.4.0 executes data files without confirmation from the user, which allows remote attackers to execute arbi CVE-2005-07555.1Heap-based buffer overflow in RealPlayer 10 and earlier, Helix Player before 10.0.4, and RealOne Player v1 and v2 allows remote attackers to CVE-2005-07562.1ptrace in Linux kernel 2.6.8.1 does not properly verify addresses on the amd64 platform, which allows local users to cause a denial of servi