BC
Product
Bigtree Cms
44
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 3High 15Medium 21Low 1
Watch
Add Bigtree Cms to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-26670 | 8.8 | Jun 1 | A vulnerability has been discovered in BigTree CMS 4.4.10 and earlier which allows an authenticated attacker to execute arbitrary commands through a crafted request sent to the… Affected: through 4.4.10 |
| CVE-2020-26668 | 8.8 | Jun 1 | A SQL injection vulnerability was discovered in /core/feeds/custom.php in BigTree CMS 4.4.10 and earlier which allows an authenticated attacker to inject a malicious SQL query to… Affected: through 4.4.10 |
| CVE-2017-11736 | 8.8 | Jul 29 | SQL injection vulnerability in core\admin\auto-modules\forms\process.php in BigTree 4.2.18 allows remote authenticated users to execute arbitrary SQL commands via the tags array… Affected: 4.2.18 |
| CVE-2017-9449 | 8.8 | Jun 6 | SQL injection vulnerability in BigTree CMS through 4.2.18 allows remote authenticated users to execute arbitrary SQL commands via… Affected: through 4.2.18 |
| CVE-2017-9444 | 8.8 | Jun 5 | BigTree CMS through 4.2.18 has CSRF related to the core\admin\modules\users\profile\update.php script (modify user information), the index.php/admin/developer/packages/delete/ URI… Affected: through 4.2.18 |
| CVE-2017-9443 | 8.8 | Jun 5 | BigTree CMS through 4.2.18 allows remote authenticated users to conduct SQL injection attacks via a crafted tables object in manifest.json in an uploaded package Affected: through 4.2.18 |
| CVE-2017-9442 | 8.8 | Jun 5 | BigTree CMS through 4.2.18 allows remote authenticated users to execute arbitrary code by uploading a crafted package containing a PHP web shell, related to extraction of a ZIP… Affected: through 4.2.18 |
| CVE-2017-9427 | 8.8 | Jun 4 | SQL injection vulnerability in BigTree CMS through 4.2.18 allows remote authenticated users to execute arbitrary SQL commands via… Affected: through 4.2.18 |
| CVE-2017-9379 | 8.8 | Jun 2 | Multiple CSRF issues exist in BigTree CMS through 4.2.18 - the clear parameter to core\admin\modules\dashboard\vitals-statistics\404\clear.php and the from or to parameter to… Affected: through 4.2.18 |
| CVE-2017-9365 | 8.8 | Jun 2 | CSRF exists in BigTree CMS through 4.2.18 with the force parameter to /admin/pages/revisions.php - for example: /admin/pages/revisions/1/?force=false Affected: through 4.2.18 |
| CVE-2017-7881 | 8.8 | Apr 15 | BigTree CMS through 4.2.17 relies on a substring check for CSRF protection, which allows remote attackers to bypass this check by placing the required admin/developer/ URI within… Affected: through 4.2.17 |
| CVE-2018-17341 | 8.1 | Sep 23 | BigTree 4.2.23 on Windows, when Advanced or Simple Rewrite routing is enabled, allows remote attackers to bypass authentication via a ..\ substring, as demonstrated by a… Affected: 4.2.23 |
| CVE-2018-17030 | 7.5 | Sep 14 | BigTree CMS 4.2.23 allows remote authenticated users, if possessing privileges to set hooks, to execute arbitrary code via /core/admin/auto-modules/forms/process.php Affected: 4.2.23 |
| CVE-2017-9428 | 7.5 | Jun 4 | A directory traversal vulnerability exists in core\admin\ajax\developer\extensions\file-browser.php in BigTree CMS through 4.2.18 on Windows, allowing attackers to read arbitrary… Affected: through 4.2.18 |
| CVE-2017-6914 | 7.1 | Mar 15 | CSRF exists in BigTree CMS 4.1.18 and 4.2.16 with the id parameter to the admin/ajax/users/delete/ page Affected: 4.1.8; 4.2.16 |
Showing 15