First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2008-7178

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

Directory traversal vulnerability in Uploader module 1.1 for XOOPS allows remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter in a downloadfile action to index.php.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Weakness enumeration

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

Timeline

Published: Sep 8, 2009
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2008

CVE-2008-71797.5OTManager CMS 2.4 allows remote attackers to bypass authentication and gain administrator privileges by setting the ADMIN_Hora, ADMIN_Logado CVE-2008-71805.0del_query1.php in Telephone Directory 2008 allows remote attackers to delete arbitrary contacts via a direct request with a modified id vari CVE-2008-71817.5Butterfly Organizer 2.0.0 allows remote attackers to (1) delete arbitrary categories via a modified tablehere parameter to category-delete.p CVE-2008-71824.0Buffer overflow in the IMAP service in NetWin Surgemail 3.9e, and possibly other versions before 3.9g2, allows remote authenticated users to CVE-2008-71836.8PHP remote file inclusion vulnerability in eva/index.php in EVA CMS 2.3.1, when register_globals is enabled, allows remote attackers to exec CVE-2008-71844.3Cross-site scripting (XSS) vulnerability in Diigo Toolbar and Diigolet allows remote attackers to inject arbitrary web script or HTML via a CVE-2008-71854.3GNOME Rhythmbox 0.11.5 allows remote attackers to cause a denial of service (segmentation fault and crash) via a playlist (.pls) file with a CVE-2008-71865.0Coppermine Photo Gallery (CPG) 1.4.14 does not restrict access to update.php, which allows remote attackers to obtain sensitive information CVE-2008-71875.0Coppermine Photo Gallery (CPG) 1.4.14 allows remote attackers to obtain sensitive information via a direct request to include/slideshow.inc.CVE-2008-71887.5ClipShare 2.6 does not properly restrict access to certain functionality, which allows remote attackers to change the profile of arbitrary u CVE-2008-718910.0Multiple unspecified vulnerabilities in Local Media Browser before 0.1 have unknown impact and attack vectors related to "Security holes."CVE-2008-719010.0Unspecified vulnerability in Adium before 1.2 has unknown impact and attack vectors related to javascript: URLs, possibly cross-site scripti

CVE-2008-7178: High severity, CVSS 7.5 | Vulnix