CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
EPSS
Percentile
85.8%
If magic quotes are off there’s a SQL injection when
sending a forgotten password. It’s possible to overwrite
the admin password and to take over the whole system. In
some files in the admin section there are some cross site
scripting vulnerabilities. In the public frontend it’s
possible to include arbitrary php files.