CVE-2008-2840

Multiple directory traversal vulnerabilities in Exero CMS 1.0.0 and 1.0.1 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the theme parameter to (1) custompage.php, (2) errors/404.php, (3) members/memberslist.php, (4) members/profile.php, (5) news/fullview.php, (6) news/index.php, (7) nopermission.php, (8) usercp/avatar.php, or (9) usercp/editpassword.php in themes/Default/. NOTE: some of these details are obtained from third party information.

• CWE-22

• http://secunia.com/advisories/30711Vendor Advisory
• http://sourceforge.net/project/shownotes.php?release_id=607502
• http://www.securityfocus.com/bid/29788Patch
• http://secunia.com/advisories/30711Vendor Advisory
• http://sourceforge.net/project/shownotes.php?release_id=607502
• http://www.securityfocus.com/bid/29788Patch

Published

Jun 24, 2008

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2008-2834SQL injection vulnerability in projects.php in Scientific Im…
• CVE-2008-2835SQL injection vulnerability in cgi-bin/igsuite in IGSuite 3.…
• CVE-2008-2836PHP remote file inclusion vulnerability in send_reminders.ph…
• CVE-2008-2837SQL injection vulnerability in index.php in CMS-BRD allows r…
• CVE-2008-2838Directory traversal vulnerability in index.php in Traindepot…
• CVE-2008-2839Cross-site scripting (XSS) vulnerability in the search modul…
• CVE-2008-2841Argument injection vulnerability in XChat 2.8.7b and earlier…
• CVE-2008-2842Cross-site scripting (XSS) vulnerability in edit/showmedia.a…
• CVE-2008-2843Multiple SQL injection vulnerabilities in doITLive CMS 2.50 …
• CVE-2008-2844SQL injection vulnerability in index.php in Carscripts Class…
• CVE-2008-2845SQL injection vulnerability in index.php in MyBizz-Classifie…
• CVE-2008-2846SQL injection vulnerability in index.php in BoatScripts Clas…