Sourceforge Vulnerabilities and Affected Products
Explore source-attributed vulnerabilities associated with Sourceforge products.
Products
- 202CMS2 vulnerabilities
- Data Center Audit2 vulnerabilities
- Easyndexer2 vulnerabilities
- Echo Mirage1 vulnerability
- GPS Tracking System1 vulnerability
- Meneame English Pligg1 vulnerability
- OpenBiz Cubi Lite1 vulnerability
- phpFileManager1 vulnerability
- Placeto CMS1 vulnerability
- SimplePress CMS1 vulnerability
- Snes9K 0.0.9z1 vulnerability
- SoX - Sound eXchange1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2019-25705HIGH | Echo Mirage 3.1 Stack Buffer Overflow via Rules Action FieldEcho Mirage 3.1 contains a stack buffer overflow vulnerability that allows local attackers to crash the application or execute arbitrary code by supplying an oversized string in the Rules action field. Attackers can create a malicious text file with a crafted payload exceeding buffer boundaries and paste it into the action field through the Rules dialog to trigger the overflow and overwrite the return address. CWE-787Apr 12, 2026 | CVSS8.6v4.0 | EPSS0.208% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2018-25251HIGH | Snes9K 0.0.9z Buffer Overflow SEH via Netplay SocketSnes9K 0.0.9z contains a buffer overflow vulnerability in the Netplay Socket Port Number field that allows local attackers to trigger a structured exception handler (SEH) overwrite. Attackers can craft a malicious payload and paste it into the Socket Port Number field via the Netplay Options menu to achieve code execution through SEH chain exploitation. CWE-787Apr 4, 2026 | CVSS8.6v4.0 | EPSS0.185% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2018-25209HIGH | OpenBiz Cubi Lite 3.0.8 SQL Injection via username ParameterOpenBiz Cubi Lite 3.0.8 contains a SQL injection vulnerability in the login form that allows unauthenticated attackers to manipulate database queries through the username parameter. Attackers can submit POST requests to /bin/controller.php with malicious SQL code in the username field to extract sensitive database information or bypass authentication. CWE-89Mar 26, 2026 | CVSS8.8v4.0 | EPSS0.327% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2019-25632MEDIUM | phpFileManager 1.7.8 Local File Inclusion via index.phpphpFileManager 1.7.8 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating the action, fm_current_dir, and filename parameters. Attackers can send GET requests to index.php with crafted parameter values to access sensitive files like /etc/passwd from the server. CWE-306Mar 24, 2026 | CVSS6.9v4.0 | EPSS0.557% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2019-25575HIGH | SimplePress CMS 1.0.7 SQL Injection via p and s ParametersSimplePress CMS 1.0.7 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'p' and 's' parameters. Attackers can send GET requests with crafted SQL payloads to extract sensitive database information including usernames, database names, and version details. CWE-89Mar 21, 2026 | CVSS8.8v4.0 | EPSS0.338% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2019-25539HIGH | 202CMS v10 beta SQL Injection via register.php202CMS v10 beta contains a blind SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the log_user parameter. Attackers can send POST requests to index.php with crafted SQL payloads using time-based blind injection techniques to extract sensitive database information. CWE-89Mar 12, 2026 | CVSS8.8v4.0 | EPSS0.415% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2019-25538HIGH | 202CMS v10 beta SQL Injection via log_user Parameter202CMS v10 beta contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the log_user parameter. Attackers can send crafted requests with malicious SQL statements in the log_user field to extract sensitive database information or modify database contents. CWE-89Mar 12, 2026 | CVSS8.8v4.0 | EPSS0.365% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2019-25529HIGH | Placeto CMS Alpha rv.4 SQL Injection via page ParameterPlaceto CMS Alpha rv.4 contains an SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the 'page' parameter. Attackers can send GET requests to the admin/edit.php endpoint with malicious 'page' values using boolean-based blind, time-based blind, or union-based techniques to extract sensitive database information. CWE-89Mar 12, 2026 | CVSS7.1v4.0 | EPSS0.284% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2018-25192HIGH | GPS Tracking System 2.12 SQL Injection via username ParameterGPS Tracking System 2.12 contains an SQL injection vulnerability that allows unauthenticated attackers to bypass authentication by injecting SQL code through the username parameter. Attackers can submit crafted POST requests to the login.php endpoint with SQL injection payloads in the username field to gain unauthorized access without valid credentials. CWE-89Mar 6, 2026 | CVSS8.8v4.0 | EPSS0.284% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2018-25190MEDIUM | Easyndexer 1.0 Cross-Site Request Forgery via createuser.phpEasyndexer 1.0 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to create administrative accounts by submitting forged POST requests. Attackers can craft malicious web pages that submit POST requests to createuser.php with parameters including username, password, name, surname, and privileges set to 1 for administrator access. CWE-352Mar 6, 2026 | CVSS6.9v4.0 | EPSS0.13% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2018-25189HIGH | Data Center Audit 2.6.2 SQL Injection via username ParameterData Center Audit 2.6.2 contains an SQL injection vulnerability in the username parameter of dca_login.php that allows unauthenticated attackers to execute arbitrary SQL queries. Attackers can submit crafted SQL payloads through POST requests to extract sensitive database information including usernames, database names, and version details. CWE-89Mar 6, 2026 | CVSS8.8v4.0 | EPSS0.237% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2018-25178HIGH | Easyndexer 1.0 Arbitrary File Download via showtif.phpEasyndexer 1.0 contains an arbitrary file download vulnerability that allows unauthenticated attackers to download sensitive files by manipulating the file parameter. Attackers can send POST requests to showtif.php with arbitrary file paths in the file parameter to retrieve system files like configuration and initialization files. CWE-22Mar 6, 2026 | CVSS8.7v4.0 | EPSS0.583% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2018-25177MEDIUM | Data Center Audit 2.6.2 Cross-Site Request Forgery via dca_resetpw.phpData Center Audit 2.6.2 contains a cross-site request forgery vulnerability that allows attackers to reset administrator passwords without authentication by submitting crafted POST requests. Attackers can send requests to dca_resetpw.php with parameters updateuser, pass, pass2, and submit_reset to change the admin account password and gain administrative access. CWE-352Mar 6, 2026 | CVSS6.9v4.0 | EPSS0.125% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2018-25166HIGH | Meneame English Pligg 5.8 SQL Injection via search ParameterMeneame English Pligg 5.8 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the search parameter. Attackers can send GET requests to index.php with crafted SQL payloads in the search parameter to extract sensitive database information including usernames, database names, and version details. CWE-89Mar 6, 2026 | CVSS8.8v4.0 | EPSS0.232% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2019-1010004MEDIUM | SoX - Sound eXchange 14.4.2 and earlier is affected by: Out-of-bounds Read. The impact is: Denial of Service. The component is: read_samples function at xa.c:219. The attack vector is: Victim must open specially crafted .xa file. NOTE: this may overlap CVE-2017-18189. CWE-125Jul 15, 2019 | CVSS5.5v3.0 | EPSS1.26% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |