CVE-2005-1896

MediumCVSS 5.0/10Last modified Jun 16, 2026

Description

Directory traversal vulnerability in thumb.php in FlatNuke 2.5.3 allows remote attackers to read arbitrary images or obtain the installation path via the image parameter.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://flatnuke.sourceforge.net/index.php?mod=read&id=1117979256Patch
http://secunia.com/advisories/15603Patch, Vendor Advisory
http://securitytracker.com/id?1014114Exploit, Patch
http://secwatch.org/advisories/secwatch/20050604_flatnuke.txtExploit, Patch, Vendor Advisory
http://www.vupen.com/english/advisories/2005/0697
http://flatnuke.sourceforge.net/index.php?mod=read&id=1117979256Patch
http://secunia.com/advisories/15603Patch, Vendor Advisory
http://securitytracker.com/id?1014114Exploit, Patch
http://secwatch.org/advisories/secwatch/20050604_flatnuke.txtExploit, Patch, Vendor Advisory
http://www.vupen.com/english/advisories/2005/0697

Timeline

Published: Jun 9, 2005
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2005

CVE-2005-189710.0Unknown vulnerability in FlexCast Audio Video Streaming Server before 2.0 has unknown impact and attack vectors.CVE-2005-18985.0The passthrough functionality in phpThumb.php in phpThumb() before 1.5.4 allows remote attackers to read files that are not images.CVE-2005-18995.0Rakkarsoft RakNet network library 2.33 and earlier, when released before 30 May 2005, and as used in multiple products including nFusion Eli CVE-2005-19007.5Sawmill before 7.1.6 allows remote attackers to bypass authentication and (1) gain administrative privileges or (2) add a license.CVE-2005-19014.3Multiple cross-site scripting (XSS) vulnerabilities in Sawmill before 7.1.6 allow remote attackers to inject arbitrary web script or HTML vi CVE-2005-19023.6Directory traversal vulnerability in the IMAP service for SPA-PRO Mail @Solomon 4.00 allows remote authenticated users to read other users' CVE-2005-19032.1Buffer overflow in the IMAP service for SPA-PRO Mail @Solomon 4.00 allows remote authenticated users to execute arbitrary code via a long CR CVE-2005-19047.5SQL injection vulnerability in login.asp in JiRo's Upload System (JUS) 1 allows remote attackers to execute arbitrary SQL commands via the p CVE-2005-19057.2The klif.sys driver in Kaspersky Labs Anti-Virus 5.0.227, 5.0.228, and 5.0.335 on Windows 2000 allows local users to gain privileges by modi CVE-2005-19067.5SQL injection vulnerability in login.asp in livingmailing 1.3 allows remote attackers to execute arbitrary SQL commands via the password. NO CVE-2005-19075.0The ISA Firewall service in Microsoft Internet Security and Acceleration (ISA) Server 2000 allows remote attackers to cause a denial of serv CVE-2005-19087.5Perception LiteWeb allows remote attackers to bypass access controls for files via an extra leading / (slash) or leading \ (backslash) in th