SimplenewsCVEs & Vulnerabilities

3 CVEs affecting Simplenews products, tracked from the National Vulnerability Database, with CVSS/EPSS scores and exploitation status.

3 CVEs→ All vendors

Most Affected Products

simplenews 3

CVE-2007-4872MEDIUM

SimpNews 2.41.03 allows remote attackers to obtain sensitive information via (1) an invalid lang parameter to admin/index.php; or a direct request to (2) admin/dbg_infos.php, (3) admin/heading.php, or (4) evsearch.php; which reveals the path in various error messages.

SimpNews 2.41.03 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download arbitrary .inc files via a direct request, as demonstrated by admin/includes/dbtables.inc.

27 Sep 2007

5.0

CVSS

CVE-2007-2598CRITICALpoc

SQL injection vulnerability in print.php in SimpleNews 1.0.0 FINAL allows remote attackers to execute arbitrary SQL commands via the news_id parameter.

11 May 2007

10.0

CVSS

← PrevPage 1 / 1Next →

← All Vendors·CVE Database