BC
Product
Bigtree Cms
44
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 3High 15Medium 21Low 1
Watch
Add Bigtree Cms to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2018-10574 | 9.8 | Apr 30 | site/index.php/admin/trees/add/ in BigTree 4.2.22 and earlier allows remote attackers to upload and execute arbitrary PHP code because the BigTreeStorage class in… Affected: through 4.2.22 |
| CVE-2017-9364 | 9.8 | Jun 2 | Unrestricted File Upload exists in BigTree CMS through 4.2.18: if an attacker uploads an 'xxx.pht' or 'xxx.phtml' file, they could bypass a safety check and execute any code Affected: through 4.2.18 |
| CVE-2017-7695 | 9.8 | Apr 11 | Unrestricted File Upload exists in BigTree CMS before 4.2.17: if an attacker uploads an 'xxx.php[space]' file, they could bypass a safety check and execute any code Affected: through 4.2.16 |
| CVE-2020-26670 | 8.8 | Jun 1 | A vulnerability has been discovered in BigTree CMS 4.4.10 and earlier which allows an authenticated attacker to execute arbitrary commands through a crafted request sent to the… Affected: through 4.4.10 |
| CVE-2020-26668 | 8.8 | Jun 1 | A SQL injection vulnerability was discovered in /core/feeds/custom.php in BigTree CMS 4.4.10 and earlier which allows an authenticated attacker to inject a malicious SQL query to… Affected: through 4.4.10 |
| CVE-2017-11736 | 8.8 | Jul 29 | SQL injection vulnerability in core\admin\auto-modules\forms\process.php in BigTree 4.2.18 allows remote authenticated users to execute arbitrary SQL commands via the tags array… Affected: 4.2.18 |
| CVE-2017-9449 | 8.8 | Jun 6 | SQL injection vulnerability in BigTree CMS through 4.2.18 allows remote authenticated users to execute arbitrary SQL commands via… Affected: through 4.2.18 |
| CVE-2017-9444 | 8.8 | Jun 5 | BigTree CMS through 4.2.18 has CSRF related to the core\admin\modules\users\profile\update.php script (modify user information), the index.php/admin/developer/packages/delete/ URI… Affected: through 4.2.18 |
| CVE-2017-9443 | 8.8 | Jun 5 | BigTree CMS through 4.2.18 allows remote authenticated users to conduct SQL injection attacks via a crafted tables object in manifest.json in an uploaded package Affected: through 4.2.18 |
| CVE-2017-9442 | 8.8 | Jun 5 | BigTree CMS through 4.2.18 allows remote authenticated users to execute arbitrary code by uploading a crafted package containing a PHP web shell, related to extraction of a ZIP… Affected: through 4.2.18 |
| CVE-2017-9427 | 8.8 | Jun 4 | SQL injection vulnerability in BigTree CMS through 4.2.18 allows remote authenticated users to execute arbitrary SQL commands via… Affected: through 4.2.18 |
| CVE-2017-9379 | 8.8 | Jun 2 | Multiple CSRF issues exist in BigTree CMS through 4.2.18 - the clear parameter to core\admin\modules\dashboard\vitals-statistics\404\clear.php and the from or to parameter to… Affected: through 4.2.18 |
| CVE-2017-9365 | 8.8 | Jun 2 | CSRF exists in BigTree CMS through 4.2.18 with the force parameter to /admin/pages/revisions.php - for example: /admin/pages/revisions/1/?force=false Affected: through 4.2.18 |
| CVE-2017-7881 | 8.8 | Apr 15 | BigTree CMS through 4.2.17 relies on a substring check for CSRF protection, which allows remote attackers to bypass this check by placing the required admin/developer/ URI within… Affected: through 4.2.17 |
| CVE-2018-17341 | 8.1 | Sep 23 | BigTree 4.2.23 on Windows, when Advanced or Simple Rewrite routing is enabled, allows remote attackers to bypass authentication via a ..\ substring, as demonstrated by a… Affected: 4.2.23 |
| CVE-2018-17030 | 7.5 | Sep 14 | BigTree CMS 4.2.23 allows remote authenticated users, if possessing privileges to set hooks, to execute arbitrary code via /core/admin/auto-modules/forms/process.php Affected: 4.2.23 |
| CVE-2017-9428 | 7.5 | Jun 4 | A directory traversal vulnerability exists in core\admin\ajax\developer\extensions\file-browser.php in BigTree CMS through 4.2.18 on Windows, allowing attackers to read arbitrary… Affected: through 4.2.18 |
| CVE-2017-6914 | 7.1 | Mar 15 | CSRF exists in BigTree CMS 4.1.18 and 4.2.16 with the id parameter to the admin/ajax/users/delete/ page Affected: 4.1.8; 4.2.16 |
| CVE-2017-16961 | 6.5 | Nov 27 | A SQL injection vulnerability in core/inc/auto-modules.php in BigTree CMS through 4.2.19 allows remote authenticated attackers to obtain information in the context of the user… Affected: through 4.2.19 |
| CVE-2017-9378 | 6.5 | Jun 2 | BigTree CMS through 4.2.18 does not prevent a user from deleting their own account Affected: through 4.2.18 |
| CVE-2018-18308 | 6.1 | Oct 16 | In the 4.2.23 version of BigTree, a Stored XSS vulnerability has been discovered in /admin/ajax/file-browser/upload/ (aka the image upload area) Affected: 4.2.23 |
| CVE-2018-1000521 | 6.1 | Jun 26 | BigTree-CMS contains a Cross Site Scripting (XSS) vulnerability in /users/create that can result in The low-privileged users can use this vulnerability to attack… Affected: 4.2.21 |
| CVE-2018-10183 | 6.1 | Apr 17 | An issue was discovered in BigTree 4.2.22 Affected: 4.2.22 |
| CVE-2017-9546 | 5.7 | Jun 12 | admin.php in BigTree through 4.2.18 allows remote authenticated users to cause a denial of service (inability to save revisions) via XSS sequences in a revision name Affected: through 4.2.18 |
| CVE-2023-44954 | 5.4 | Nov 1 | Cross Site Scripting vulnerability in BigTree CMS v.4.5.7 allows a remote attacker to execute arbitrary code via the ID parameter in the Developer Settings functions Affected: 4.5.7 |
| CVE-2022-36197 | 5.4 | Aug 3 | BigTree CMS 4.4.16 was discovered to contain an arbitrary file upload vulnerability which allows attackers to execute arbitrary code via a crafted PDF file Affected: 4.4.16 |
| CVE-2020-18467 | 5.4 | Aug 26 | Cross Site Scripting (XSS) vulnerabilty exists in BigTree-CMS 4.4.3 in the tag name field found in the Tags page under the General menu via a crafted website name by doing an… Affected: 4.4.3 |
| CVE-2020-26669 | 5.4 | Jun 1 | A stored cross-site scripting (XSS) vulnerability was discovered in BigTree CMS 4.4.10 and earlier which allows an authenticated attacker to execute arbitrary web scripts or HTML… Affected: through 4.4.10 |
| CVE-2018-18380 | 5.4 | Oct 19 | A Session Fixation issue was discovered in Bigtree before 4.2.24 Affected: before 4.2.24 |
| CVE-2018-10364 | 5.4 | Apr 30 | BigTree before 4.2.22 has XSS in the Users management page via the name or company field Affected: before 4.2.22 |
| CVE-2018-6013 | 5.4 | Jan 23 | Cross-site scripting (XSS) in BigTree 4.2.19 allows any remote users to inject arbitrary web script or HTML via the directory parameter Affected: 4.2.19 |
| CVE-2017-9548 | 5.4 | Jun 12 | admin.php in BigTree through 4.2.18 has a Cross-site Scripting (XSS) vulnerability, which allows remote authenticated users to inject arbitrary web script or HTML by launching a… Affected: through 4.2.18 |
| CVE-2017-9547 | 5.4 | Jun 12 | admin.php in BigTree through 4.2.18 has a Cross-site Scripting (XSS) vulnerability, which allows remote authenticated users to inject arbitrary web script or HTML by launching an… Affected: through 4.2.18 |
| CVE-2017-9448 | 5.4 | Jun 6 | Cross-site scripting (XSS) vulnerabilities in BigTree CMS through 4.2.18 allow remote authenticated users to inject arbitrary web script or HTML via the description parameter Affected: through 4.2.18 |
| CVE-2016-10223 | 5.4 | Feb 14 | An issue was discovered in BigTree CMS before 4.2.15 Affected: through 4.2.14 |
| CVE-2017-6918 | 4.3 | Mar 15 | CSRF exists in BigTree CMS 4.2.16 with the value[#][*] parameter to the admin/settings/update/ page Affected: 4.2.16 |
| CVE-2017-6917 | 4.3 | Mar 15 | CSRF exists in BigTree CMS 4.2.16 with the value parameter to the admin/settings/update/ page Affected: 4.2.16 |
| CVE-2017-6916 | 4.3 | Mar 15 | CSRF exists in BigTree CMS 4.1.18 with the nav-social[#] parameter to the admin/settings/update/ page Affected: 4.1.8 |
| CVE-2017-6915 | 4.3 | Mar 15 | CSRF exists in BigTree CMS 4.1.18 with the colophon parameter to the admin/settings/update/ page Affected: 4.1.8 |
| CVE-2017-9441 | 2.7 | Jun 5 | Multiple cross-site scripting (XSS) vulnerabilities in BigTree CMS through 4.2.18 allow remote authenticated users to inject arbitrary web script or HTML by uploading a crafted… Affected: through 4.2.18 |
| CVE-2013-5313 | – | Aug 19 | Cross-site request forgery (CSRF) vulnerability in core/admin/modules/users/update.php in BigTree CMS 4.0 RC2 and earlier allows remote attackers to hijack the authentication of… Affected: through 4.0; 4.0; 4.0; 4.0; 4.0; 4.0; +3 more |
| CVE-2013-4881 | – | Aug 19 | Cross-site request forgery (CSRF) vulnerability in core/admin/modules/users/create.php in BigTree CMS 4.0 RC2 and earlier allows remote attackers to hijack the authentication of… Affected: through 4.0; 4.0; 4.0; 4.0; 4.0; 4.0; +3 more |
| CVE-2013-4880 | – | Aug 14 | Cross-site scripting (XSS) vulnerability in core/admin/modules/developer/modules/views/add.php in BigTree CMS 4.0 RC2 and earlier allows remote attackers to inject arbitrary web… Affected: through 4.0; 4.0; 4.0; 4.0; 4.0; 4.0; +3 more |
| CVE-2013-4879 | – | Aug 14 | SQL injection vulnerability in core/inc/bigtree/cms.php in BigTree CMS 4.0 RC2 and earlier allows remote attackers to execute arbitrary SQL commands via the PATH_INFO to index.php Affected: through 4.0; 4.0; 4.0; 4.0; 4.0; 4.0; +3 more |
Showing 44