websvn vulnerabilities

Products

• websvn 7

Latest websvn CVEs

Newest publication first

1. CVE-2011-2195 A flaw was found in WebSVN 2.3.2. Without prior authentication, if the 'allowDownload' option is enabled in config.php, an attacker can invoke the dl.php script and pass a well formed 'path' argument....

   Published 2021-10-26

   Critical·CVSS 9.8 EPSS 2.7%

   A flaw was found in WebSVN 2.3.2. Without prior authentication, if the 'allowDownload' option is enabled in config.php, an attacker can invoke the dl.php script and pass a well formed 'path' argument to execute arbitrary commands against the underlying operating system.

2. CVE-2021-32305 WebSVN before 2.6.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the search parameter.

   Published 2021-05-18

   Critical·CVSS 9.8 EPSS 87.3% Public exploit

   WebSVN before 2.6.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the search parameter.

3. CVE-2016-1236 Multiple cross-site scripting (XSS) vulnerabilities in (1) revision.php, (2) log.php, (3) listing.php, and (4) comp.php in WebSVN allow context-dependent attackers to inject arbitrary web script or HT...

   Published 2016-05-11

   Medium·CVSS 6.1 EPSS 0.86%

   Multiple cross-site scripting (XSS) vulnerabilities in (1) revision.php, (2) log.php, (3) listing.php, and (4) comp.php in WebSVN allow context-dependent attackers to inject arbitrary web script or HTML via the name of a (a) file or (b) directory in a repository.

4. CVE-2016-2511 Cross-site scripting (XSS) vulnerability in WebSVN 2.3.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the path parameter to log.php.

   Published 2016-04-07

   Medium·CVSS 6.1 EPSS 1.7%

   Cross-site scripting (XSS) vulnerability in WebSVN 2.3.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the path parameter to log.php.

5. CVE-2013-6892 WebSVN 2.3.3 allows remote authenticated users to read arbitrary files via a symlink attack in a commit.

   Published 2015-01-21

   Low·CVSS 3.5 EPSS 0.96%

   WebSVN 2.3.3 allows remote authenticated users to read arbitrary files via a symlink attack in a commit.

6. CVE-2011-5221 Cross-site scripting (XSS) vulnerability in the getLog function in svnlook.php in WebSVN before 2.3.1 allows remote attackers to inject arbitrary web script or HTML via the path parameter to (1) comp....

   Published 2012-10-25

   Medium·CVSS 4.3 EPSS 2.5%

   Cross-site scripting (XSS) vulnerability in the getLog function in svnlook.php in WebSVN before 2.3.1 allows remote attackers to inject arbitrary web script or HTML via the path parameter to (1) comp.php, (2) diff.php, or (3) revision.php.

7. CVE-2007-3056 Cross-site scripting (XSS) vulnerability in filedetails.php in WebSVN 2.0rc4, and possibly earlier, allows remote attackers to inject arbitrary web script or HTML via the path parameter.

   Published 2007-06-06

   Medium·CVSS 4.3 EPSS 1.6%

   Cross-site scripting (XSS) vulnerability in filedetails.php in WebSVN 2.0rc4, and possibly earlier, allows remote attackers to inject arbitrary web script or HTML via the path parameter.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.