CVE-2008-6938

MediumCVSS 4.3/10Last modified Jun 16, 2026

Description

Pi3Web 2.0.3 before PL2, when installed on Windows as a desktop application and without using the Pi3Web/Conf/Intenet.pi3, allows remote attackers to cause a denial of service (crash or hang) and obtain the full pathname of the server via a request to a file in the ISAPI directory that is not an executable DLL, which triggers the crash when the DLL load fails, as demonstrated using Isapi\users.txt.

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:N/I:N/A:P

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published: Aug 11, 2009
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2008

CVE-2008-69397.5TurnkeyForms Web Hosting Directory allows remote attackers to bypass authentication and (1) gain administrative privileges by setting the ad CVE-2008-69407.5TurnkeyForms Web Hosting Directory stores sensitive information under the web root with insufficient access control, which allows remote att CVE-2008-69417.5SQL injection vulnerability in the login functionality in TurnkeyForms Web Hosting Directory allows remote attackers to execute arbitrary SQ CVE-2008-69426.5Unrestricted file upload vulnerability in ScriptsFeed Realtor Classifieds System (aka Real Estate Classifieds) allows remote authenticated u CVE-2008-69436.5Unrestricted file upload vulnerability in ScriptsFeed Recipes Listing Portal allows remote authenticated users to execute arbitrary code by CVE-2008-69446.5Unrestricted file upload vulnerability in ScriptsFeed Auto Classifieds allows remote authenticated users to execute arbitrary code by upload CVE-2008-69454.3Multiple cross-site scripting (XSS) vulnerabilities in Interchange 5.7 before 5.7.1, 5.6 before 5.6.1, and 5.4 before 5.4.3 allow remote att CVE-2008-69464.3Cross-site scripting (XSS) vulnerability in manageproject.php in Collabtive 0.4.8 allows user-assisted remote attackers to inject arbitrary CVE-2008-69477.5Collabtive 0.4.8 allows remote attackers to bypass authentication and create new users, including administrators, via unspecified vectors as CVE-2008-69486.5Unrestricted file upload vulnerability in Collabtive 0.4.8 allows remote authenticated users to execute arbitrary code by uploading a file w CVE-2008-69496.8Multiple cross-site request forgery (CSRF) vulnerabilities in Collabtive 0.4.8 allow remote attackers to hijack the authentication of admini CVE-2008-69507.5Multiple SQL injection vulnerabilities in login.asp in Bankoi WebHosting Control Panel 1.20 allow remote attackers to execute arbitrary SQL