Turnkeyforms develops a portfolio of web-based business and directory applications including local classifieds, text link sales, web hosting directories, and survey platforms, where vulnerabilities concentrate in application-layer input handling and access control. Its disclosures recur through SQL injection, cross-site scripting, and improper authentication weaknesses that are characteristic of web applications lacking robust input validation and session management. Current severity, exploitation activity, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Turnkeyforms over time
Signals from CVEs in this vendor scope (12 CVEs).
12 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2008-6940HIGH TurnkeyForms Web Hosting Directory stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain a database backup via a | Aug 12, 2009 | 7.5 | 29 | NO | YES |
CVE-2008-6939HIGH TurnkeyForms Web Hosting Directory allows remote attackers to bypass authentication and (1) gain administrative privileges by setting the adm cookie to 1 or (2) gain privileges as | Aug 12, 2009 | 7.5 | 29 | NO | YES |
CVE-2008-6723HIGH TurnkeyForms Entertainment Portal 2.0 allows remote attackers to bypass authentication and gain administrative access by setting the adminLogged cookie to Administrator. | Apr 14, 2009 | 7.5 | 29 | NO | YES |
CVE-2008-6302HIGH TurnkeyForms Local Classifieds allows remote attackers to bypass authentication and gain administrative access via a direct request to Site_Admin/admin.php. | Feb 26, 2009 | 7.5 | 29 | NO | YES |
CVE-2008-6963HIGH admin.php in TurnkeyForms Text Link Sales allows remote attackers to bypass authentication and gain administrative privileges via a direct request. | Aug 13, 2009 | 7.5 | 28 | NO | YES |
CVE-2008-6941HIGH SQL injection vulnerability in the login functionality in TurnkeyForms Web Hosting Directory allows remote attackers to execute arbitrary SQL commands via the password field. | Aug 12, 2009 | 7.5 | 28 | NO | YES |
CVE-2008-6350HIGH SQL injection vulnerability in listtest.php in TurnkeyForms Local Classifieds allows remote attackers to execute arbitrary SQL commands via the r parameter. | Mar 2, 2009 | 7.5 | 28 | NO | YES |
CVE-2008-6349HIGH SQL injection vulnerability in survey_results_text.php in TurnkeyForms Business Survey Pro 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter. | Mar 2, 2009 | 7.5 | 28 | NO | YES |
CVE-2008-5486HIGH SQL injection vulnerability in admin.php in TurnkeyForms Text Link Sales allows remote attackers to execute arbitrary SQL commands via the id parameter. | Dec 12, 2008 | 7.5 | 28 | NO | YES |
CVE-2009-4858MEDIUM Cross-site scripting (XSS) vulnerability in questiondetail.php in Yahoo Answers Clone allows remote attackers to inject arbitrary web script or HTML via the questionid parameter. | May 11, 2010 | 4.3 | 22 | NO | YES |
Signals from CVEs in this vendor scope (12 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Turnkeyforms.
Media articles that mention a CVE ID that affects a product developed by Turnkeyforms — matched by CVE ID, not by vendor name.