CVE-2005-1404

MediumCVSS 5.0/10Last modified Jun 16, 2026

Description

MyPHP Forum 1.0 allows remote attackers to spoof the username by modifying the (1) nbuser parameter to post.php or (2) sender parameter to privmsg.php.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:N/I:P/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://secunia.com/advisories/15166Vendor Advisory
http://www.osvdb.org/15902Exploit, Patch, Vendor Advisory
http://www.osvdb.org/15903Exploit, Vendor Advisory
http://www.securityfocus.com/bid/13429
http://www.securityfocus.com/bid/13430
http://www.securityfocus.org/archive/1/397025Exploit, Patch, Vendor Advisory
http://secunia.com/advisories/15166Vendor Advisory
http://www.osvdb.org/15902Exploit, Patch, Vendor Advisory
http://www.osvdb.org/15903Exploit, Vendor Advisory
http://www.securityfocus.com/bid/13429
http://www.securityfocus.com/bid/13430
http://www.securityfocus.org/archive/1/397025Exploit, Patch, Vendor Advisory

Timeline

Published: May 3, 2005
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2005

CVE-2005-14052.1HTTP response splitting vulnerability in the @SetHTTPHeader function in Lotus Domino 6.5.x before 6.5.4 and 6.0.x before 6.0.5 allows attack CVE-2005-14064.6The kernel in FreeBSD 4.x to 4.11 and 5.x to 5.4 does not properly clear certain fixed-length buffers when copying variable-length data for CVE-2005-14074.6Skype for Windows 1.2.0.0 to 1.2.0.46 allows local users to bypass the identity check for an authorized application, then call arbitrary Sky CVE-2005-14085.0Apple Keynote 2.0 and 2.0.1 allows remote attackers to read arbitrary files via the keynote: URI handler in a crafted Keynote presentation.CVE-2005-14097.5PostgreSQL 7.3.x through 8.0.x gives public EXECUTE access to certain character conversion functions, which allows unprivileged users to cal CVE-2005-14102.1The tsearch2 module in PostgreSQL 7.4 through 8.0.x declares the (1) dex_init, (2) snb_en_init, (3) snb_ru_init, (4) spell_init, and (5) syn CVE-2005-14114.6Cybration ICUII 7.0 stores passwords in plaintext in the world-readable icuii.ini file, which allows local users to gain privileges.CVE-2005-14127.5SQL injection vulnerability in verify.asp for Ecomm Professional Guestbook 3.x allows remote attackers to execute arbitrary SQL commands via CVE-2005-14137.5Multiple SQL injection vulnerabilities in enVivo!CMS allow remote attackers to execute arbitrary SQL commands and gain privileges via the (1 CVE-2005-14144.6ExoticSoft FilePocket 1.2 stores sensitive proxy information, including proxy passwords, in plaintext in the registry, which allows local us CVE-2005-141510.0Buffer overflow in GlobalSCAPE Secure FTP Server 3.0.2 allows remote authenticated users to execute arbitrary code via a long FTP command.CVE-2005-14165.0Directory traversal vulnerability in 04WebServer 1.81 allows remote attackers to read files outside of the web root but within the installat