Login Request a demo
BI
Vendor
Bigtreecms
2 products with CVEs on record
45
CVEs
0
On KEV
0
New 30D
Products
BC
Bigtree Cms
Bigtreecms
9.8
44 CVEs0 on KEV0 new
BI
Bigtree
Bigtreecms
2.7
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2023-44954
BC
Bigtree Cms
Bigtreecms
5.4
1%
Nov 1Cross Site Scripting vulnerability in BigTree CMS v.4.5.7 allows a remote attacker to execute arbitrary code via the ID parameter in the Developer Settings functions
CVE-2022-36197
BC
Bigtree Cms
Bigtreecms
5.4
1%
Aug 3BigTree CMS 4.4.16 was discovered to contain an arbitrary file upload vulnerability which allows attackers to execute arbitrary code via a crafted PDF file
CVE-2020-18467
BC
Bigtree Cms
Bigtreecms
5.4
0%
Aug 26Cross Site Scripting (XSS) vulnerabilty exists in BigTree-CMS 4.4.3 in the tag name field found in the Tags page under the General menu via a crafted website name by doing an…
CVE-2020-26670
BC
Bigtree Cms
Bigtreecms
8.8
2%
Jun 1A vulnerability has been discovered in BigTree CMS 4.4.10 and earlier which allows an authenticated attacker to execute arbitrary commands through a crafted request sent to the…
CVE-2020-26669
BC
Bigtree Cms
Bigtreecms
5.4
1%
Jun 1A stored cross-site scripting (XSS) vulnerability was discovered in BigTree CMS 4.4.10 and earlier which allows an authenticated attacker to execute arbitrary web scripts or HTML…
CVE-2020-26668
BC
Bigtree Cms
Bigtreecms
8.8
1%
Jun 1A SQL injection vulnerability was discovered in /core/feeds/custom.php in BigTree CMS 4.4.10 and earlier which allows an authenticated attacker to inject a malicious SQL query to…
CVE-2018-20405
BI
Bigtree
Bigtreecms
2.7
1%
Dec 23BigTree 4.3 allows full path disclosure via authenticated admin/news/ input that triggers a syntax error
CVE-2018-18380
BC
Bigtree Cms
Bigtreecms
5.4
1%
Oct 19A Session Fixation issue was discovered in Bigtree before 4.2.24
CVE-2018-18308
BC
Bigtree Cms
Bigtreecms
6.1
4%
Oct 16In the 4.2.23 version of BigTree, a Stored XSS vulnerability has been discovered in /admin/ajax/file-browser/upload/ (aka the image upload area)
CVE-2018-17341
BC
Bigtree Cms
Bigtreecms
8.1
2%
Sep 23BigTree 4.2.23 on Windows, when Advanced or Simple Rewrite routing is enabled, allows remote attackers to bypass authentication via a ..\ substring, as demonstrated by a…
CVE-2018-17030
BC
Bigtree Cms
Bigtreecms
7.5
2%
Sep 14BigTree CMS 4.2.23 allows remote authenticated users, if possessing privileges to set hooks, to execute arbitrary code via /core/admin/auto-modules/forms/process.php
CVE-2018-1000521
BC
Bigtree Cms
Bigtreecms
6.1
1%
Jun 26BigTree-CMS contains a Cross Site Scripting (XSS) vulnerability in /users/create that can result in The low-privileged users can use this vulnerability to attack…
CVE-2018-10364
BC
Bigtree Cms
Bigtreecms
5.4
1%
Apr 30BigTree before 4.2.22 has XSS in the Users management page via the name or company field
CVE-2018-10574
BC
Bigtree Cms
Bigtreecms
9.8
2%
Apr 30site/index.php/admin/trees/add/ in BigTree 4.2.22 and earlier allows remote attackers to upload and execute arbitrary PHP code because the BigTreeStorage class in…
CVE-2018-10183
BC
Bigtree Cms
Bigtreecms
6.1
1%
Apr 17An issue was discovered in BigTree 4.2.22
CVE-2018-6013
BC
Bigtree Cms
Bigtreecms
5.4
1%
Jan 23Cross-site scripting (XSS) in BigTree 4.2.19 allows any remote users to inject arbitrary web script or HTML via the directory parameter
CVE-2017-16961
BC
Bigtree Cms
Bigtreecms
6.5
1%
Nov 27A SQL injection vulnerability in core/inc/auto-modules.php in BigTree CMS through 4.2.19 allows remote authenticated attackers to obtain information in the context of the user…
CVE-2017-11736
BC
Bigtree Cms
Bigtreecms
8.8
1%
Jul 29SQL injection vulnerability in core\admin\auto-modules\forms\process.php in BigTree 4.2.18 allows remote authenticated users to execute arbitrary SQL commands via the tags array…
CVE-2017-9548
BC
Bigtree Cms
Bigtreecms
5.4
1%
Jun 12admin.php in BigTree through 4.2.18 has a Cross-site Scripting (XSS) vulnerability, which allows remote authenticated users to inject arbitrary web script or HTML by launching a…
CVE-2017-9547
BC
Bigtree Cms
Bigtreecms
5.4
1%
Jun 12admin.php in BigTree through 4.2.18 has a Cross-site Scripting (XSS) vulnerability, which allows remote authenticated users to inject arbitrary web script or HTML by launching an…
CVE-2017-9546
BC
Bigtree Cms
Bigtreecms
5.7
1%
Jun 12admin.php in BigTree through 4.2.18 allows remote authenticated users to cause a denial of service (inability to save revisions) via XSS sequences in a revision name
CVE-2017-9449
BC
Bigtree Cms
Bigtreecms
8.8
1%
Jun 6SQL injection vulnerability in BigTree CMS through 4.2.18 allows remote authenticated users to execute arbitrary SQL commands via…
CVE-2017-9448
BC
Bigtree Cms
Bigtreecms
5.4
1%
Jun 6Cross-site scripting (XSS) vulnerabilities in BigTree CMS through 4.2.18 allow remote authenticated users to inject arbitrary web script or HTML via the description parameter
CVE-2017-9444
BC
Bigtree Cms
Bigtreecms
8.8
0%
Jun 5BigTree CMS through 4.2.18 has CSRF related to the core\admin\modules\users\profile\update.php script (modify user information), the index.php/admin/developer/packages/delete/ URI…
CVE-2017-9443
BC
Bigtree Cms
Bigtreecms
8.8
1%
Jun 5BigTree CMS through 4.2.18 allows remote authenticated users to conduct SQL injection attacks via a crafted tables object in manifest.json in an uploaded package
CVE-2017-9442
BC
Bigtree Cms
Bigtreecms
8.8
2%
Jun 5BigTree CMS through 4.2.18 allows remote authenticated users to execute arbitrary code by uploading a crafted package containing a PHP web shell, related to extraction of a ZIP…
CVE-2017-9441
BC
Bigtree Cms
Bigtreecms
2.7
1%
Jun 5Multiple cross-site scripting (XSS) vulnerabilities in BigTree CMS through 4.2.18 allow remote authenticated users to inject arbitrary web script or HTML by uploading a crafted…
CVE-2017-9428
BC
Bigtree Cms
Bigtreecms
7.5
2%
Jun 4A directory traversal vulnerability exists in core\admin\ajax\developer\extensions\file-browser.php in BigTree CMS through 4.2.18 on Windows, allowing attackers to read arbitrary…
CVE-2017-9427
BC
Bigtree Cms
Bigtreecms
8.8
2%
Jun 4SQL injection vulnerability in BigTree CMS through 4.2.18 allows remote authenticated users to execute arbitrary SQL commands via…
CVE-2017-9379
BC
Bigtree Cms
Bigtreecms
8.8
0%
Jun 2Multiple CSRF issues exist in BigTree CMS through 4.2.18 - the clear parameter to core\admin\modules\dashboard\vitals-statistics\404\clear.php and the from or to parameter to…
CVE-2017-9378
BC
Bigtree Cms
Bigtreecms
6.5
1%
Jun 2BigTree CMS through 4.2.18 does not prevent a user from deleting their own account
CVE-2017-9365
BC
Bigtree Cms
Bigtreecms
8.8
0%
Jun 2CSRF exists in BigTree CMS through 4.2.18 with the force parameter to /admin/pages/revisions.php - for example: /admin/pages/revisions/1/?force=false
CVE-2017-9364
BC
Bigtree Cms
Bigtreecms
9.8
1%
Jun 2Unrestricted File Upload exists in BigTree CMS through 4.2.18: if an attacker uploads an 'xxx.pht' or 'xxx.phtml' file, they could bypass a safety check and execute any code
CVE-2017-7881
BC
Bigtree Cms
Bigtreecms
8.8
1%
Apr 15BigTree CMS through 4.2.17 relies on a substring check for CSRF protection, which allows remote attackers to bypass this check by placing the required admin/developer/ URI within…
CVE-2017-7695
BC
Bigtree Cms
Bigtreecms
9.8
2%
Apr 11Unrestricted File Upload exists in BigTree CMS before 4.2.17: if an attacker uploads an 'xxx.php[space]' file, they could bypass a safety check and execute any code
CVE-2017-6918
BC
Bigtree Cms
Bigtreecms
4.3
0%
Mar 15CSRF exists in BigTree CMS 4.2.16 with the value[#][*] parameter to the admin/settings/update/ page
CVE-2017-6917
BC
Bigtree Cms
Bigtreecms
4.3
0%
Mar 15CSRF exists in BigTree CMS 4.2.16 with the value parameter to the admin/settings/update/ page
CVE-2017-6916
BC
Bigtree Cms
Bigtreecms
4.3
0%
Mar 15CSRF exists in BigTree CMS 4.1.18 with the nav-social[#] parameter to the admin/settings/update/ page
CVE-2017-6915
BC
Bigtree Cms
Bigtreecms
4.3
0%
Mar 15CSRF exists in BigTree CMS 4.1.18 with the colophon parameter to the admin/settings/update/ page
CVE-2017-6914
BC
Bigtree Cms
Bigtreecms
7.1
0%
Mar 15CSRF exists in BigTree CMS 4.1.18 and 4.2.16 with the id parameter to the admin/ajax/users/delete/ page
CVE-2016-10223
BC
Bigtree Cms
Bigtreecms
5.4
1%
Feb 14An issue was discovered in BigTree CMS before 4.2.15
CVE-2013-5313
BC
Bigtree Cms
Bigtreecms
–
1%
Aug 19Cross-site request forgery (CSRF) vulnerability in core/admin/modules/users/update.php in BigTree CMS 4.0 RC2 and earlier allows remote attackers to hijack the authentication of…
CVE-2013-4881
BC
Bigtree Cms
Bigtreecms
–
2%
Aug 19Cross-site request forgery (CSRF) vulnerability in core/admin/modules/users/create.php in BigTree CMS 4.0 RC2 and earlier allows remote attackers to hijack the authentication of…
CVE-2013-4880
BC
Bigtree Cms
Bigtreecms
–
3%
Aug 14Cross-site scripting (XSS) vulnerability in core/admin/modules/developer/modules/views/add.php in BigTree CMS 4.0 RC2 and earlier allows remote attackers to inject arbitrary web…
CVE-2013-4879
BC
Bigtree Cms
Bigtreecms
–
2%
Aug 14SQL injection vulnerability in core/inc/bigtree/cms.php in BigTree CMS 4.0 RC2 and earlier allows remote attackers to execute arbitrary SQL commands via the PATH_INFO to index.php