Archive
Personal security-research blog by David Vieira-Kurz. Advisories, exploit analyses and write-ups since 2006.
CVE & GHSA
| ID | Product | Type |
|---|---|---|
| GHSA-mf2p-h6hf-fcwm (2026) | TinyMCE (<= 8.9.2) | Cross-Site Scripting (stored) (write-up) |
| GHSA-jhhp-r3r7-v2cg (2026) | Jodit (npm, <= 4.17.0) | Cross-Site Scripting (stored) (write-up) |
| SCEditor 3.2.2 (2026) | SCEditor (<= 3.2.1) | Cross-Site Scripting (stored) |
| phpMyFAQ SA-2026-10-03 | phpMyFAQ (<= 4.1.8) | Cross-Site Scripting (stored) (write-up) |
| TYPO3-CORE-SA-2016-004 | TYPO3 CMS (Form component) | Cross-Site Scripting |
| CVE-2016-4977 | Spring Security OAuth | Remote Code Execution (write-up) |
| CVE-2016-3109 | Shopware | Remote Code Execution |
| CVE-2012-0674 | Apple iOS / Mobile Safari | Address Bar Spoofing (write-up) |
| CVE-2011-4634 | phpMyAdmin | Cross-Site Scripting |
| CVE-2011-0635 | Simploo CMS | Remote Code Execution |
| CVE-2011-0508 | Contao CMS | Cross-Site Scripting (stored) |
| CVE-2010-2339 | Subdreamer CMS | SQL Injection |
| CVE-2008-6131 | moziloWiki | Session Fixation |
| CVE-2008-6130 | moziloWiki | Cross-Site Scripting |
| CVE-2008-6129 | moziloWiki | Directory Traversal |
| CVE-2008-6128 | moziloCMS | Directory Traversal, Cross-Site Scripting, Session Fixation |
| CVE-2008-6127 | moziloCMS | Directory Traversal, Cross-Site Scripting, Session Fixation |
| CVE-2008-6045 | xt:Commerce | Session Fixation |
| CVE-2008-6044 | xt:Commerce | Cross-Site Scripting |
| CVE-2008-6039 | BLUEPAGE CMS | Cross-Site Scripting, Session Fixation |
| CVE-2007-3988 | Virtual Hosting Control System (VHCS) | Session Fixation |
| CVE-2007-2546 | Simple Machines Forum (SMF) | Session Fixation |
| CVE-2007-2277 | Plogger | Session Fixation |
| CVE-2007-2153 | @Mail (ATMail) | Cross-Site Scripting |
| CVE-2007-2061 | MailBee WebMail Pro | Cross-Site Scripting |
| CVE-2007-1952 | onebyone CMS | Session Fixation |
| CVE-2007-1950 | webblizzard CMS | Cross-Site Scripting |
| CVE-2007-1949 | webblizzard CMS | Session Fixation |
| CVE-2006-7077 | Advanced Guestbook for phpBB | SQL Injection |
| CVE-2006-7076 | Advanced Guestbook for phpBB | Cross-Site Scripting |
| CVE-2006-6451 | Plesk | Cross-Site Scripting |
| CVE-2006-5643 | ForeSite CMS | Cross-Site Scripting |
27 assigned CVE IDs, 2 GHSA and 3 vendor advisories, 2006-2026. CVE IDs link to NVD, GHSA IDs to their GitHub advisories. Mirrored from github.com/secalert.
My archived security advisories
| Date | Product | Type | Advisory |
|---|---|---|---|
| 2013-02-05 | Sony PlayStation Vita Browser (Firmware <= 2.05) | Address Bar Spoofing (window.open) | SA-2013-014 [2] [3] |
| 2010-08-13 | WordPress (3.0.1) | Reflected XSS (wp-admin/plugins.php checked[0]) | SA-080 [2] [3] |
| 2010-07-27 | PHPKIT WCMS (1.6.5) | Reflected XSS (searchtext) | SA-078 [2] [3] |
| 2010-07-27 | PHPKIT WCMS (<= 1.6.5) | Stored XSS (gbook_welcome, rss_page_text) | SA-079 [2] [3] |
| 2010-07-20 | XINHA Editor Plugin ExtendedFileManager (0.96.1) | XSS (backend.php mode) | SA-077 [2] |
| 2010-07-15 | ConPresso CMS (4.1.1) | XSS (mod_search q/rubric) | SA-076 [2] [3] |
| 2010-06-19 | CMS RedAks (2.0) | SQL Injection (search_area) | SA-075 [2] [3] |
| 2010-06-17 | CMS RedAks (2.0) | Multiple Stored XSS (search) | SA-074 |
| 2010-06-10 | chillyCMS (1.1.2) | CSRF (Admin-Passwortaenderung) | SA-066 |
| 2010-06-10 | Invision Power Board (<= 3.0.5) | Full Path Disclosure (Type-Casting) | SA-067 |
| 2010-06-10 | phpFaber CMS (2.0.5) | Multiple Stored XSS | SA-071 [2] [3] |
| 2010-06-09 | Gazelle CMS (1.0) | CSRF (Admin-Passwortaenderung) | SA-068 |
| 2010-06-09 | Invision Power Board (<= 3.0.5) | Stored XSS (Calendar) | SA-069 [2] |
| 2010-06-09 | Plume CMS (1.2.4) | CSRF (Admin-Passwortaenderung) | SA-070 [2] [3] |
| 2010-02-07 | Motorola Milestone (Droid) Browser (Android 2.0, Build SHOLS_U2_01.03.1) | Remote DoS (WebKit Memory Corruption) | #65 [2] [3] |
| 2010-02-02 | Apple Safari (Desktop) (<= 4.0.4) | Remote DoS (JavaScript-Engine, marquee) | #64 [2] |
| 2009-12-04 | Mozilla Firefox (<= 3.5.4 (Liste: 3.5.5)) | Memory Corruption / Remote Crash | #60 |
| 2009-10-16 | PHP (file_get_contents) (<= 5.3, <= 5.2.11) | Prefix-Bypass + Poison Null Byte | #58 |
| 2009-09-28 | PHP (preg_match) (<= 5.3, <= 5.2.11) | Full Path Disclosure | #57 [2] [3] |
| 2009-09-28 | PHP (mysqli_real_escape_string) (<= 5.3, <= 5.2.11) | Full Path Disclosure | #59 [2] |
| 2009-01-26 | ConPresso CMS (4.07) | XSS, Cross-Domain Scripting, Session Fixation | advisory |
| 2008-10-16 | WEB//NEWS | SQL Injection + Cookie Manipulation | HACKATTACK-20081016 |
| 2008-05-12 | ActualAnalyzer Server/Gold/Pro/Lite (Server <= 8.37, Gold <= 7.74, Pro <= 6.95, Lite <= 2.78) | XSS (view.php language) | #52 [2] |
| 2007-06-01 | Calimero.CMS (<= 3.3.1232) | Session Fixation | #49 [2] |
| 2007-06-01 | chameleon CMS (<= 3.0) | Session Fixation | #50 [2] [3] |
| 2007-05-29 | eggblog (<= 3.1.0) | Session Fixation | #48 [2] |
| 2007-04-15 | oe2edit CMS | XSS + Cookie Manipulation (oe2edit.cgi q) | #45 [2] |
| 2007-04-06 | oboShop | Session Fixation | #40 [2] |
| 2007-04-06 | courts online | Session Fixation | #41 [2] |
| 2007-04-04 | eXV2 CMS (<= 2.0.4.3) | Session Fixation + XSS | #38 [2] |
| 2007-04-03 | holaCMS (1.4.10) | XSS (index_cms.php acuparam) | #37 [2] |
| 2006-11-18 | Travelsized CMS (<= 0.4.1) | Multiple XSS | #35 |
| 2006-11-18 | dev4u CMS | Multiple SQL Injection + XSS | #36 |
| 2006-11-11 | ShopSystems (<= 4.0) | SQL Injection | #33 |
| 2006-11-06 | phpComasy CMS (<= 0.7.9 pre) | Multiple XSS | #32 [2] |
| 2006-11-04 | admin.tool 3 CMS (<= 3) | Multiple XSS | #30 |
| 2006-11-04 | xenis.creator CMS | Multiple XSS + SQL Injection | #31 |
| 2006-09-29 | ConPresso CMS (<= 4.0.4a) | Multiple XSS + SQL Injection | #28 [2] |
| 2006-08-03 | Toenda CMS (<= 1.1 (unstable)) | XSS | #27 [2] |
| 2006-07-23 | WoltLab Burning Board (1.1.1, 1.2, 2.1.3, 2.1.5, 2.2, 2.2.1, 2.2.2) | Cookie Manipulation + Session Fixation | #26 [2] |
| 2006-07-22 | Fire-Mouse TopList (<= 1.1) | XSS + SQL Injection | #24 |
| 2006-07-21 | BLOG:CMS (<= 4.0.0j) | XSS + Cookie Disclosure | #23 |
| 2006-07-20 | Top XL (<= 1.1) | XSS + Cookie Disclosure | #22 |
| 2006-07-19 | phpFaber TopSites (<= 2.0.9) | SQL Injection + XSS | #21 |
| 2006-07-18 | SiteDepth CMS (<= 3.01) | Remote File Inclusion (SD_DIR) | #20 |
| 2006-06-23 | AutoRank PHP / AutoRank Pro (PHP <= 3.02, Pro <= 5.01) | Multiple XSS + Cookie Disclosure | #19 |
| 2006-06-12 | SixCMS (<= 6) | Multiple XSS + Directory Traversal | #17 |
| 2006-06-12 | RIG - Ralf Image Gallery (<= 0.7.4 (unstable), <= 0.6.45 (stable)) | Multiple XSS, RFI, Directory Traversal | #18 |
| 2006-06-10 | OpenCms (<= 6.2.1) | XSS | #11 |
| 2006-06-10 | ZMS (<= 2.9) | XSS (raw) | #12 |
| 2006-06-10 | Cabacos Web CMS (<= 3.8.498) | XSS | #13 |
| 2006-06-10 | CFXe-CMS (<= 2.0) | XSS | #14 |
| 2006-06-08 | i.List toplist ranking system (<= 1.5 Beta) | XSS / Script Insertion | #10 |
| 2006-06-03 | DreamAccount (<= 3.1) | Remote File Inclusion (da_path) | #8 |
| 2006-06-03 | HostAdmin (<= 3.1) | Remote File Inclusion | #9 |
| 2006-06-02 | dotWidget CMS (<= 1.0.6) | Remote File Inclusion (file_path) | #7 [2] |
| 2006-05-23 | SocketMail Lite/Pro (<= 2.2.6) | Remote File Inclusion | #6 |
| 2006-05-04 | phpListPro (<= 2.01) | Multiple Remote File Inclusion | #5 |
| 2006-04-24 | phpMyAgenda (3.0 Final und frueher) | Remote File Inclusion (rootagenda) | #4 |
| 2006-04-23 | TotalCalendar (<= 2.30) | Remote File Inclusion (inc_dir) | #3 |
| 2006-04-19 | ActualAnalyzer Lite/Gold/Server (Lite <= 2.72, Gold <= 7.63, Server <= 8.23) | Remote File Inclusion (direct.php rf) | #2 [2] |
| 2006-04-11 | phpListPro (<= 2.00) | Remote File Inclusion | #1 |
62 archived advisories, 2006-2013, originally published as MajorSecurity releases and mirrored via web.archive.org and public mailing lists. These predate and are kept separate from the CVE/GHSA list above.