CVE-2010-5086
Quick assessment
Affected
n/a n/a
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Bitweaver是一套免费、开源的Web应用框架和内容管理系统。该系统包含文章管理、Wiki、Blog、图片管理、日历、用户管理等模块。 Bitweaver中存在本地文件包含漏洞，该漏洞源于对用户提供的输入未经充分过滤。攻击者可利用此漏洞在web服务器进程中查看文件，进而执行本地脚本，这可能导致进一步的攻击。Bitweaver 2.8.1版本中存在漏洞，其它版本也可能受到影响。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2010-5086
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
Directory traversal vulnerability in wiki/rankings.php in Bitweaver 2.7 and 2.8.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the style parameter.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Bitweaver ‘rankings.php’ 本地文件包含漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Bitweaver是一套免费、开源的Web应用框架和内容管理系统。该系统包含文章管理、Wiki、Blog、图片管理、日历、用户管理等模块。 Bitweaver中存在本地文件包含漏洞，该漏洞源于对用户提供的输入未经充分过滤。攻击者可利用此漏洞在web服务器进程中查看文件，进而执行本地脚本，这可能导致进一步的攻击。Bitweaver 2.8.1版本中存在漏洞，其它版本也可能受到影响。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | n/a | n/a | - |
|
II. Public POCs for CVE-2010-5086
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2010-5086
请登录查看更多情报信息。
Vendor Advisories for CVE-2010-5086 (2)
Exploits & Public PoCs for CVE-2010-5086 (1)
Other References for CVE-2010-5086 (1)
Same Patch Batch · n/a · 2012-03-19 · 33 CVEs total
| CVE-2012-1297 | Contao ‘main.php’多个跨站请求伪造漏洞 | |
| CVE-2012-1776 | VideoLAN VLC Media Player缓冲区溢出漏洞 | |
| CVE-2012-1775 | VideoLAN VLC Media Player缓冲区溢出漏洞 | |
| CVE-2012-1790 | Webgrind绝对路径遍历漏洞 | |
| CVE-2012-1789 | Kongreg8多个跨站脚本漏洞 | |
| CVE-2012-1788 | WonderDesk SQL ‘wonderdesk.cgi’ 多个跨站脚本漏洞 | |
| CVE-2012-1787 | Webglimpse多个跨站脚本漏洞 | |
| CVE-2012-1786 | WordPress Video Embed/Thumbnail Generator插件安全漏洞 | |
| CVE-2012-1785 | WordPress ‘kg_callffmpeg.php’ 任意命令执行漏洞 | |
| CVE-2012-1784 | MyJobList ‘eid’ 参数SQL注入漏洞 | |
| CVE-2012-1783 | Tiny Server拒绝服务漏洞 | |
| CVE-2012-1782 | OSQA's CMS多个HTML注入漏洞 | |
| CVE-2012-1781 | SocialCMS ‘ajax/commentajax.php’ 跨站脚本漏洞 | |
| CVE-2012-1780 | SocialCMS ‘search.php’ SQL注入漏洞 | |
| CVE-2012-1779 | IDevSpot idev-BusinessDirectory跨站脚本漏洞 | |
| CVE-2012-1778 | CreateVision CMS ‘artykul_print.php’ SQL注入漏洞 | |
| CVE-2012-0328 | Janetter安全漏洞 | |
| CVE-2011-5083 | Dotclear ‘swfupload.swf’远程任意文件上传漏洞 | |
| CVE-2011-5082 | WordPress ‘s2Member Pro’插件HTML注入漏洞 | |
| CVE-2009-5114 | WebGlimpse ‘wgarcmin.cgi’ 目录遍历漏洞 |
Showing top 20 of 33 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same vendor: n/a
V. Comments for CVE-2010-5086
No comments yet