Dream4 develops a family of content management systems—Koobi CMS, Koobi Pro, and Koobi—that are moderately represented in the vulnerability landscape. Vulnerabilities affecting the vendor concentrate on SQL injection and related input-handling flaws, and public exploit code is frequently available for disclosed issues, making timely patching critical for deployed instances. Defenders should monitor this vendor's releases and treat SQL injection exposure in web-facing CMS products as a high-priority remediation target; current severity, exploitation activity, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Dream4 over time
Signals from CVEs in this vendor scope (11 CVEs).
11 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2008-1122HIGH SQL injection vulnerability in the downloads module in Koobi Pro 5.7 allows remote attackers to execute arbitrary SQL commands via the categ parameter to index.php. NOTE: it was l | Mar 3, 2008 | 7.5 | 32 | NO | YES |
CVE-2008-6210HIGH SQL injection vulnerability in index.php in dream4 Koobi 4.4 and 5.4 allows remote attackers to execute arbitrary SQL commands via the img_id parameter in the gallerypic page. | Feb 20, 2009 | 7.5 | 28 | NO | YES |
CVE-2008-4778HIGH SQL injection vulnerability in the gallery module in Koobi CMS 4.3.0 allows remote attackers to execute arbitrary SQL commands via the galid parameter in a showimages action. | Oct 29, 2008 | 7.5 | 28 | NO | YES |
CVE-2008-2036HIGH SQL injection vulnerability in index.php in dream4 Koobi Pro 6.25 allows remote attackers to execute arbitrary SQL commands via the poll_id parameter in a poll action. | Apr 30, 2008 | 7.5 | 28 | NO | YES |
CVE-2006-3621HIGH SQL injection vulnerability in the showtopic module in Koobi Pro CMS 5.6 allows remote attackers to execute arbitrary SQL commands via the toid parameter. | Jul 18, 2006 | 7.5 | 28 | NO | YES |
CVE-2005-0890HIGH SQL injection vulnerability in Dream4 Koobi CMS 4.2.3 allows remote attackers to execute arbitrary SQL commands via the area parameter. | May 2, 2005 | 7.5 | 28 | NO | YES |
CVE-2005-4588MEDIUM Cross-site scripting (XSS) vulnerability in Koobi 5 allows remote attackers to inject arbitrary web script or HTML via nested, malformed url BBCode tags. NOTE: the provenance of t | Dec 30, 2005 | 4.3 | 21 | NO | YES |
CVE-2005-0889MEDIUM Cross-site scripting (XSS) vulnerability in index.php for Dream4 Koobi CMS 4.2.3 allows remote attackers to inject arbitrary web script or HTML via the area parameter. | Mar 24, 2005 | 4.3 | 21 | NO | YES |
CVE-2005-1373HIGH Multiple SQL injection vulnerabilities in index.php in Dream4 Koobi CMS 4.2.3 allow remote attackers to execute arbitrary SQL commands via the (1) q or (2) p parameters. | May 3, 2005 | 7.5 | 19 | NO | NO |
CVE-2006-3622MEDIUM The showtopic module in Koobi Pro CMS 5.6 allows remote attackers to obtain sensitive information via a ' (single quote) in the p parameter, which displays the path in an error mes | Jul 18, 2006 | 5.0 | 15 | NO | NO |
Signals from CVEs in this vendor scope (11 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Dream4.
Media articles that mention a CVE ID that affects a product developed by Dream4 — matched by CVE ID, not by vendor name.