Bcoos develops a focused line of web applications including its core platform, DevTracker, and Event Calendar, with a small but prominent vulnerability footprint centered on application-layer input-handling flaws. The vendor's disclosures recur across SQL injection, cross-site scripting, and path-traversal weaknesses that are characteristic of web applications lacking robust input validation and output encoding. Current severity, exploitation activity, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Bcoos over time
Signals from CVEs in this vendor scope (10 CVEs).
10 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2007-6266HIGH Multiple SQL injection vulnerabilities in bcoos 1.0.10 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the gid parameter to modules/arcade/index.php in | Dec 7, 2007 | 7.5 | 28 | NO | YES |
CVE-2007-6275HIGH SQL injection vulnerability in modules/adresses/ratefile.php in bcoos 1.0.10 and earlier allows remote attackers to execute arbitrary SQL commands via the lid parameter, a differen | Dec 7, 2007 | 7.5 | 28 | NO | YES |
CVE-2007-6080HIGH SQL injection vulnerability in modules/banners/click.php in the banners module for bcoos 1.0.10 allows remote attackers to execute arbitrary SQL commands via the bid parameter. NO | Nov 21, 2007 | 7.5 | 28 | NO | YES |
CVE-2007-6079MEDIUM Directory traversal vulnerability in include/common.php in bcoos 1.0.10 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the xoopsOption[p | Nov 21, 2007 | 6.8 | 27 | NO | YES |
CVE-2008-2350MEDIUM Directory traversal vulnerability in highlight.php in bcoos 1.0.9 through 1.0.13 allows remote attackers to read arbitrary files via (1) .. (dot dot) or (2) C: folder sequences in | May 20, 2008 | 5.0 | 23 | NO | YES |
CVE-2008-6381MEDIUM SQL injection vulnerability in modules/adresses/viewcat.php in bcoos 1.0.13, and possibly earlier, allows remote authenticated users with Addresses module permissions to execute ar | Mar 2, 2009 | 4.6 | 22 | NO | YES |
CVE-2008-7036MEDIUM Multiple cross-site scripting (XSS) vulnerabilities in index.php in DevTracker module 3.0 for bcoos 1.1.11 and earlier, and DevTracker module 0.20 for E-XooPS 1.0.8 and earlier, al | Aug 24, 2009 | 4.3 | 21 | NO | YES |
CVE-2007-5104HIGH SQL injection vulnerability in index.php in the Arcade module in bcoos 1.0.10 allows remote attackers to execute arbitrary SQL commands via the gid parameter in a play_game action. | Sep 26, 2007 | 7.5 | 19 | NO | NO |
CVE-2007-6365MEDIUM Cross-site scripting (XSS) vulnerability in modules/ecal/display.php in the Event Calendar in bcoos 1.0.10 allows remote attackers to inject arbitrary web script or HTML via the mo | Dec 15, 2007 | 4.3 | 14 | NO | NO |
CVE-2007-6274MEDIUM Multiple cross-site scripting (XSS) vulnerabilities in modules/ecal/display.php in the Event Calendar in bcoos 1.0.10 and earlier allow remote attackers to inject arbitrary web scr | Dec 7, 2007 | 4.3 | 14 | NO | NO |
Signals from CVEs in this vendor scope (10 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Bcoos.
Media articles that mention a CVE ID that affects a product developed by Bcoos — matched by CVE ID, not by vendor name.