Butterflymedia Butterfly Organizer vulnerabilities
4 known vulnerabilities affecting butterflymedia/butterfly_organizer.
Total CVEs
4
CISA KEV
0
Public exploits
4
Exploited in wild
0
Severity breakdown
HIGH3MEDIUM1
Vulnerabilities
Page 1 of 1
CVE-2008-7181P3HIGHCVSS 7.5PoCv2.0.02009-09-08
CVE-2008-7181 [HIGH] CWE-264 CVE-2008-7181: Butterfly Organizer 2.0.0 allows remote attackers to (1) delete arbitrary categories via a modified
Butterfly Organizer 2.0.0 allows remote attackers to (1) delete arbitrary categories via a modified tablehere parameter to category-delete.php with the is_js_confirmed parameter set to 1, or (2) delete arbitrary accounts via the mytable parameter to delete.php.
nvd
CVE-2008-6311P3HIGHCVSS 7.5PoCv2.0.12009-02-27
CVE-2008-6311 [HIGH] CWE-89 CVE-2008-6311: SQL injection vulnerability in view.php in Butterfly Organizer 2.0.1 allows remote attackers to exec
SQL injection vulnerability in view.php in Butterfly Organizer 2.0.1 allows remote attackers to execute arbitrary SQL commands via the mytable parameter. NOTE: the id vector is covered by another CVE name.
nvd
CVE-2008-6328P3HIGHCVSS 7.5PoCv2.0.0v2.0.12009-02-27
CVE-2008-6328 [HIGH] CWE-89 CVE-2008-6328: SQL injection vulnerability in view.php in Butterfly Organizer 2.0.0 and 2.0.1 allows remote attacke
SQL injection vulnerability in view.php in Butterfly Organizer 2.0.0 and 2.0.1 allows remote attackers to execute arbitrary SQL commands via the id parameter.
nvd
CVE-2008-6700P4MEDIUMCVSS 4.3PoCv2.0.02009-04-10
CVE-2008-6700 [MEDIUM] CWE-79 CVE-2008-6700: Multiple cross-site scripting (XSS) vulnerabilities in Butterfly Organizer 2.0.0 allow remote attack
Multiple cross-site scripting (XSS) vulnerabilities in Butterfly Organizer 2.0.0 allow remote attackers to inject arbitrary web script or HTML via the (1) mytable parameter to view.php, (2) mytable parameter to viewdb2.php, (3) tablehere parameter to category-rename.php, and (4) letter parameter to module-contacts.php.
nvd