CVE-2005-1298

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

The inserter.cgi script allows remote attackers to read arbitrary files via a full pathname in the argument.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected software

No affected versions have been published.

Timeline

Published
Apr 25, 2005
Last modified
Jun 16, 2026
NVD status
Modified

Related CVEs from 2005

CVE-2005-129910.0The inserter.cgi script allows remote attackers to execute arbitrary commands via shell metacharacters in the argument.CVE-2005-13006.8Cross-site scripting (XSS) vulnerability in the inserter.cgi script allows remote attackers to inject arbitrary web script or HTML via the aCVE-2005-13012.6nProtect:Netizen 2005.3.17.1 does not properly verify that the update module is downloaded from an authorized site, which allows remote maliCVE-2005-13027.5SQL injection vulnerability in Confixx 3.08 and earlier allows remote attackers to execute arbitrary SQL commands via the "change user" fielCVE-2005-13037.5The citat.pl script allows remote attackers to read arbitrary files via a full pathname in the argument.CVE-2005-13047.5The citat.pl script allows remote attackers to execute arbitrary files via shell metacharacters in the argument.CVE-2005-13055.0The hyper.cgi script allows remote attackers to read arbitrary files via a full pathname in the argument.CVE-2005-13067.5The Adobe Reader control in Adobe Reader and Acrobat 7.0 and 7.0.1 allows remote attackers to determine the existence of files via JavascripCVE-2005-13077.2The (1) stopserver.sh and (2) startserver.sh scripts in Adobe Version Cue on Mac OS X uses the current working directory to find and executeCVE-2005-13087.5SqWebMail allows remote attackers to inject arbitrary web script or HTML via CRLF sequences in the redirect parameter followed by the desireCVE-2005-13094.3Cross-site scripting (XSS) vulnerability in bBlog 0.7.4 allows remote attackers to inject arbitrary web script or HTML via the (1) entry titCVE-2005-13107.5SQL injection vulnerability in bBlog 0.7.4 allows remote attackers to execute arbitrary SQL commands via the postid parameter.
CVE-2005-1298: High severity, CVSS 7.5 | Vulnix