Multiple direct static code injection vulnerabilities in PHPGedView 3.3.7 and earlier allow remote attackers to execute arbitrary PHP code via (1) the username field in login.php, or the (2) user_language, (3) user_email, and (4) user_gedcomid parameters in login_register.php, which is directly inserted into authenticate.php.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Phpgedview | Phpgedview | * | 3.3.7 (including) |
| Phpgedview | Phpgedview | 2.52.3 (including) | 2.52.3 (including) |
| Phpgedview | Phpgedview | 2.60 (including) | 2.60 (including) |
| Phpgedview | Phpgedview | 2.61 (including) | 2.61 (including) |
| Phpgedview | Phpgedview | 2.61.1 (including) | 2.61.1 (including) |
| Phpgedview | Phpgedview | 2.65 (including) | 2.65 (including) |
| Phpgedview | Phpgedview | 2.65.1 (including) | 2.65.1 (including) |
| Phpgedview | Phpgedview | 2.65.2 (including) | 2.65.2 (including) |
| Phpgedview | Phpgedview | 2.65_beta5 (including) | 2.65_beta5 (including) |