CVE-2010-4401

Description

References

• osvdb.org/69632
• packetstormsecurity.org/files/view/96230/dynpg-lfisqldisclose.txt · Exploit
• dynpg.org/cms-freeware_en.php · Patch
• exploit-db.com/exploits/15646 · Exploit
• htbridge.ch/advisory/path_disclosure_in_dynpg.html · Exploit

More vulnerabilities in dynpg

• CVE-2020-27406MEDIUM 5.4Cross Site Scripting (XSS) vulnerability in DynPG 4.9.1, allows authenticated attackers to execute arbitrary code via the groupname.
• CVE-2021-27531MEDIUM 4.8A cross-site scripting (XSS) vulnerability in DynPG version 4.9.2 allows remote attackers to inject JavaScript via the "query" parameter.
• CVE-2021-27530MEDIUM 4.8A cross-site scripting (XSS) vulnerability in DynPG version 4.9.2 allow remote attacker to inject javascript via URI in /index.php.
• CVE-2021-27529MEDIUM 4.8A cross-site scripting (XSS) vulnerability in DynPG version 4.9.2 allows remote attackers to inject JavaScript via the "limit" parameter.
• CVE-2021-27528MEDIUM 4.8A cross-site scripting (XSS) vulnerability in DynPG version 4.9.2 allows remote attackers to inject JavaScript via the "refID" parameter.