IN
Vendor
Indexhibit
8
CVEs
0
On KEV
0
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2020-18127 | IN Indexhibit Indexhibit | 6.5 | Aug 30 | An issue in the /config/config.php component of Indexhibit 2.1.5 allows attackers to arbitrarily view files |
| CVE-2020-18126 | IN Indexhibit Indexhibit | 5.4 | Aug 30 | Multiple stored cross-site scripting (XSS) vulnerabilities in the Sections module of Indexhibit 2.1.5 allows attackers to execute arbitrary web scripts or HTML |
| CVE-2020-18125 | IN Indexhibit Indexhibit | 6.1 | Aug 30 | A reflected cross-site scripting (XSS) vulnerability in the /plugin/ajax.php component of Indexhibit 2.1.5 allows attackers to execute arbitrary web scripts or HTML |
| CVE-2020-18124 | IN Indexhibit Indexhibit | 5.7 | Aug 30 | A cross-site request forgery (CSRF) vulnerability in Indexhibit 2.1.5 allows attackers to arbitrarily reset account passwords |
| CVE-2020-18123 | IN Indexhibit Indexhibit | 6.5 | Aug 30 | A cross-site request forgery (CSRF) vulnerability in Indexhibit 2.1.5 allows attackers to arbitrarily delete admin accounts |
| CVE-2020-18121 | IN Indexhibit Indexhibit | 8.8 | Aug 30 | A configuration issue in Indexhibit 2.1.5 allows authenticated attackers to modify .php files, leading to getshell |
| CVE-2019-16314 | IN Indexhibit Indexhibit | 9.8 | Sep 14 | Indexhibit 2.1.5 allows a product reinstallation, with resultant remote code execution, via /ndxzstudio/install.php?p=2 |
| CVE-2019-8954 | IN Indexhibit Indexhibit | 8.8 | Feb 20 | In Indexhibit 2.1.5, remote attackers can execute arbitrary code via the v parameter (in conjunction with the id parameter) in a upd_jxcode=true action to the ndxzstudio/?a=system… |