turnkeyforms web hosting directory vulnerabilities

Latest turnkeyforms web hosting directory CVEs

Newest publication first

1. CVE-2008-6939 TurnkeyForms Web Hosting Directory allows remote attackers to bypass authentication and (1) gain administrative privileges by setting the adm cookie to 1 or (2) gain privileges as another user by sett...

   Published 2009-08-12

   High·CVSS 7.5 EPSS 3.1% Public exploit

   TurnkeyForms Web Hosting Directory allows remote attackers to bypass authentication and (1) gain administrative privileges by setting the adm cookie to 1 or (2) gain privileges as another user by setting the logged cookie to the target username.

2. CVE-2008-6940 TurnkeyForms Web Hosting Directory stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain a database backup via a direct request to a...

   Published 2009-08-12

   High·CVSS 7.5 EPSS 2.8% Public exploit

   TurnkeyForms Web Hosting Directory stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain a database backup via a direct request to admin/backup/db.

3. CVE-2008-6941 SQL injection vulnerability in the login functionality in TurnkeyForms Web Hosting Directory allows remote attackers to execute arbitrary SQL commands via the password field.

   Published 2009-08-12

   High·CVSS 7.5 EPSS 1.1% Public exploit

   SQL injection vulnerability in the login functionality in TurnkeyForms Web Hosting Directory allows remote attackers to execute arbitrary SQL commands via the password field.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.