Efiction
Vendor:
First CVE: Dec 11, 2005 · Active for 20 years
10
Total CVEs
More Total CVEs than 85% of tracked products
2.5
Avg CVEs / Year
Higher CVE frequency than 93% of tracked products
6.3
Avg CVSS
Higher Avg CVSS than 30% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Efiction over time
Volume of CVEsAvg CVSS Base Score
First CVE
Dec 11, 2005
20 years ago
Most Recent CVE
Jun 18, 2008
6,614 days ago
CVE Severity & Scoring
Efiction10 CVEs
60%
40%
All CVEs352,785 CVEs
45%
40%
11%
MediumHigh
Attack Vector
Local0 (0.0%)
Network0 (0.0%)
Unknown10 (100.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low0 (0.0%)
High0 (0.0%)
Unknown10 (100.0%)
User Interaction
None0 (0.0%)
Unknown10 (100.0%)
Required0 (0.0%)
Privileges Required
Low0 (0.0%)
High0 (0.0%)
None0 (0.0%)
Unknown10 (100.0%)
Top CVEs
Signals from CVEs in this product scope (10 CVEs).
10 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2005-4171HIGH The "Upload new image" command in the "Manage Images" eFiction 1.1, when members are allowed to upload images, allows remote attackers to execute arbitrary PHP code by uploading a | Dec 11, 2005 | 7.5 | 31 | NO | YES |
CVE-2005-4168HIGH Multiple SQL injection vulnerabilities in eFiction 1.0, 1.1, and 2.0 allow remote attackers to execute arbitrary SQL commands via (1) the let parameter in a viewlist action to titl | Dec 11, 2005 | 7.5 | 29 | NO | YES |
CVE-2005-4169HIGH Multiple SQL injection vulnerabilities in eFiction 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) let parameter in a viewlist action to authors.php and (2 | Dec 11, 2005 | 7.5 | 28 | NO | YES |
CVE-2005-4170HIGH SQL injection vulnerability in eFiction 1.1 allows remote attackers to execute arbitrary SQL commands via the uid parameter to viewuser.php. | Dec 11, 2005 | 7.5 | 28 | NO | YES |
CVE-2007-1118MEDIUM Multiple PHP remote file inclusion vulnerabilities in eFiction 3.1.1 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the path_to_smf parameter to (1) | Feb 27, 2007 | 6.8 | 27 | NO | YES |
CVE-2008-2754MEDIUM SQL injection vulnerability in toplists.php in eFiction 3.0 and 3.4.3, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the list par | Jun 18, 2008 | 6.8 | 26 | NO | YES |
CVE-2006-4427MEDIUM index.php in eFiction before 2.0.7 allows remote attackers to bypass authentication and gain privileges by setting the (1) adminloggedin, (2) loggedin, and (3) level parameters to | Aug 29, 2006 | 5.1 | 23 | NO | YES |
CVE-2005-4167MEDIUM Cross-site scripting (XSS) vulnerability in eFiction 1.0 and 1.1 allows remote attackers to inject arbitrary web script or HTML via the let parameter in a viewlist action to titles | Dec 11, 2005 | 4.3 | 22 | NO | YES |
CVE-2005-4173MEDIUM eFiction 1.0, 1.1, and 2.0 allows remote attackers to obtain sensitive information by accessing phpinfo.php, which executes the PHP phpinfo function. | Dec 11, 2005 | 5.0 | 18 | NO | NO |
CVE-2005-4172MEDIUM eFiction 1.0, 1.1, and 2.0 allows remote attackers to obtain sensitive information via a direct request to storyblock.php without arguments, which leaks the full pathname in the re | Dec 11, 2005 | 5.0 | 15 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (10 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
8 CVEs
80.0% of CVEs· 91st percentile
Social Chatter
Signals from CVEs in this product scope (10 CVEs).
Media Mentions
Signals from CVEs in this product scope (10 CVEs).
Top CNAs Publishing CVEs For Efiction
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 3.4.3 | 1 | 6.8 | 0.9% | 0 | 1 |
| 3.0 | 1 | 6.8 | 0.9% | 0 | 1 |
| 2.0.6 | 1 | 5.1 | 3.0% | 0 | 1 |
| 2.0 | 4 | 5.7 | 2.5% | 0 | 2 |
| 1.1 | 7 | 6.0 | 3.4% | 0 | 5 |
| 1.0 | 6 | 5.7 | 2.6% | 0 | 4 |