Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2008-6960 Details

Description

download.php in X10media x10 Automatic Mp3 Search Engine Script 1.5.5 through 1.6 allows remote attackers to read arbitrary files via an encoded url parameter, as demonstrated by obtaining database credentials from includes/constants.php.

Metrics

CVSS 3.x Severity and Vector Strings:

No CVSS 3.x data is available for this CVE.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
http://osvdb.org/49797 CVEExploit
http://secunia.com/advisories/32537 CVEVendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/46489 CVE
https://www.exploit-db.com/exploits/7074 CVE
http://www.securityfocus.com/bid/32227 CVEExploit

see all 12 references

Weakness Enumeration

CWE-IDCWE NameSource
CWE-264Permissions, Privileges, and Access Controls[email protected]

Affected Products

ProductVersions
x10media x10 automatic mp3 script
1.5.5
1.6

CPE

  • cpe:2.3:a:x10media:x10_automatic_mp3_script:1.5.5:*:*:*:*:*:*:*
  • cpe:2.3:a:x10media:x10_automatic_mp3_script:1.6:*:*:*:*:*:*:*

Remediation

  • No remediation found in references.

Change History

7 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2008-6960
NVD Published Date:
Aug 12, 2009
NVD Last Modified:
Jun 16, 2026
Source:
[email protected]
CVE-2008-6960 Details - Not Deferred