| Package | Affected versions | Patched versions |
|---|---|---|
| phpgedview | = 2.52.3= 2.60= 2.61= 2.61.1= 2.65= 2.65.1= 2.65.2= 2.65_beta5≤ 3.3.7 |
Multiple direct static code injection vulnerabilities in PHPGedView 3.3.7 and earlier allow remote attackers to execute arbitrary PHP code via (1) the username field in login.php, or the (2) user_language, (3) user_email, and (4) user_gedcomid parameters in login_register.php, which is directly inserted into authenticate.php.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free