Drake Team's vulnerability footprint centers on a single content-management system product that recurs across a modestly represented set of disclosures. The durable signal is a cluster of application-layer input-handling and code-generation weaknesses—including code injection, path traversal, cross-site scripting, and SQL injection—typical of server-side web applications, alongside elevated public exploit availability for these vulnerability classes. Live severity, exploitation activity, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Drake Team over time
Signals from CVEs in this vendor scope (8 CVEs).
8 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2008-6475HIGH SQL injection vulnerability in the guestbook component (components/guestbook/guestbook.php) in Drake CMS 0.4.11 and earlier allows remote attackers to execute arbitrary SQL command | Mar 16, 2009 | 7.5 | 29 | NO | YES |
CVE-2007-1849HIGH Directory traversal vulnerability in 404.php in Drake CMS allows remote attackers to include and execute arbitrary local arbitrary files via a .. (dot dot) in the d_private paramet | Apr 3, 2007 | 7.5 | 28 | NO | YES |
CVE-2006-5767MEDIUM PHP remote file inclusion vulnerability in includes/xhtml.php in Drake CMS 0.2.2 alpha rev.846 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the d_ | Nov 6, 2006 | 6.8 | 27 | NO | YES |
Absolute path traversal vulnerability in install/index.php in Drake CMS 0.4.11 RC8 allows remote attackers to read and execute arbitrary files via a full pathname in the d_root par | Mar 18, 2008 | 3.6 | 22 | NO | YES |
CVE-2007-2618MEDIUM CRLF injection vulnerability in index.php in Drake CMS 0.4.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences | May 11, 2007 | 5.1 | 15 | NO | NO |
CVE-2007-1850MEDIUM Directory traversal vulnerability in classes/captcha/captcha.jpg.php in Drake CMS allows remote attackers to read arbitrary files or list arbitrary directories, and obtain the inst | Apr 3, 2007 | 5.0 | 15 | NO | NO |
CVE-2007-6695MEDIUM Cross-site scripting (XSS) vulnerability in index.php in Drake CMS 0.4.9 allows remote attackers to inject arbitrary web script or HTML via the option parameter. | Feb 1, 2008 | 4.3 | 14 | NO | NO |
CVE-2007-1848MEDIUM Cross-site scripting (XSS) vulnerability in admin/classes/ui.dta.php in Drake CMS allows remote attackers to inject arbitrary web script or HTML via the desc[][title] field. NOTE: | Apr 3, 2007 | 4.3 | 14 | NO | NO |
Signals from CVEs in this vendor scope (8 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Drake Team.
Media articles that mention a CVE ID that affects a product developed by Drake Team — matched by CVE ID, not by vendor name.