Bigtreecms - vulnerabilities (CVEs)

45 CVEs in 2 products, 0 in the last 30 days, newest from 2023-11-01.

Products

Bigtree Cms - 44 CVEs
Bigtree - 1 CVEs

Newest CVEs of Bigtreecms

CVE-2023-44954 - CVSS 5.4 (medium), 2023-11-01: Cross Site Scripting vulnerability in BigTree CMS v.4.5.7 allows a remote attacker to execute arbitrary code via the ID parameter in the Developer Settings…
CVE-2022-36197 - CVSS 5.4 (medium), 2022-08-03: BigTree CMS 4.4.16 was discovered to contain an arbitrary file upload vulnerability which allows attackers to execute arbitrary code via a crafted PDF file.
CVE-2020-18467 - CVSS 5.4 (medium), 2021-08-26: Cross Site Scripting (XSS) vulnerabilty exists in BigTree-CMS 4.4.3 in the tag name field found in the Tags page under the General menu via a crafted website…
CVE-2020-26670 - CVSS 8.8 (high), 2021-06-01: A vulnerability has been discovered in BigTree CMS 4.4.10 and earlier which allows an authenticated attacker to execute arbitrary commands through a crafted…
CVE-2020-26669 - CVSS 5.4 (medium), 2021-06-01: A stored cross-site scripting (XSS) vulnerability was discovered in BigTree CMS 4.4.10 and earlier which allows an authenticated attacker to execute arbitrary…
CVE-2020-26668 - CVSS 8.8 (high), 2021-06-01: A SQL injection vulnerability was discovered in /core/feeds/custom.php in BigTree CMS 4.4.10 and earlier which allows an authenticated attacker to inject a…
CVE-2018-20405 - CVSS 2.7 (low), 2018-12-23: BigTree 4.3 allows full path disclosure via authenticated admin/news/ input that triggers a syntax error. NOTE: This has been disputed with the following…
CVE-2018-18380 - CVSS 5.4 (medium), 2018-10-19: A Session Fixation issue was discovered in Bigtree before 4.2.24. admin.php accepts a user-provided PHP session ID instead of regenerating a new one after a…
CVE-2018-18308 - CVSS 6.1 (medium), 2018-10-16: In the 4.2.23 version of BigTree, a Stored XSS vulnerability has been discovered in /admin/ajax/file-browser/upload/ (aka the image upload area).
CVE-2018-17341 - CVSS 8.1 (high), 2018-09-23: BigTree 4.2.23 on Windows, when Advanced or Simple Rewrite routing is enabled, allows remote attackers to bypass authentication via a ..\ substring, as…
CVE-2018-17030 - CVSS 7.5 (high), 2018-09-14: BigTree CMS 4.2.23 allows remote authenticated users, if possessing privileges to set hooks, to execute arbitrary code via…
CVE-2018-1000521 - CVSS 6.1 (medium), 2018-06-26: BigTree-CMS contains a Cross Site Scripting (XSS) vulnerability in /users/create that can result in The low-privileged users can use this vulnerability to…
CVE-2018-10364 - CVSS 5.4 (medium), 2018-04-30: BigTree before 4.2.22 has XSS in the Users management page via the name or company field.
CVE-2018-10574 - CVSS 9.8 (critical), 2018-04-30: site/index.php/admin/trees/add/ in BigTree 4.2.22 and earlier allows remote attackers to upload and execute arbitrary PHP code because the BigTreeStorage…
CVE-2018-10183 - CVSS 6.1 (medium), 2018-04-17: An issue was discovered in BigTree 4.2.22. There is cross-site scripting (XSS) in /core/inc/lib/less.php/test/index.php because of a $_SERVER['REQUEST_URI']…
CVE-2018-6013 - CVSS 5.4 (medium), 2018-01-23: Cross-site scripting (XSS) in BigTree 4.2.19 allows any remote users to inject arbitrary web script or HTML via the directory parameter. This issue exists in…
CVE-2017-16961 - CVSS 6.5 (medium), 2017-11-27: A SQL injection vulnerability in core/inc/auto-modules.php in BigTree CMS through 4.2.19 allows remote authenticated attackers to obtain information in the…
CVE-2017-11736 - CVSS 8.8 (high), 2017-07-29: SQL injection vulnerability in core\admin\auto-modules\forms\process.php in BigTree 4.2.18 allows remote authenticated users to execute arbitrary SQL commands…
CVE-2017-9546 - CVSS 5.7 (medium), 2017-06-12: admin.php in BigTree through 4.2.18 allows remote authenticated users to cause a denial of service (inability to save revisions) via XSS sequences in a…
CVE-2017-9548 - CVSS 5.4 (medium), 2017-06-12: admin.php in BigTree through 4.2.18 has a Cross-site Scripting (XSS) vulnerability, which allows remote authenticated users to inject arbitrary web script or…
CVE-2017-9547 - CVSS 5.4 (medium), 2017-06-12: admin.php in BigTree through 4.2.18 has a Cross-site Scripting (XSS) vulnerability, which allows remote authenticated users to inject arbitrary web script or…
CVE-2017-9449 - CVSS 8.8 (high), 2017-06-06: SQL injection vulnerability in BigTree CMS through 4.2.18 allows remote authenticated users to execute arbitrary SQL commands via…
CVE-2017-9448 - CVSS 5.4 (medium), 2017-06-06: Cross-site scripting (XSS) vulnerabilities in BigTree CMS through 4.2.18 allow remote authenticated users to inject arbitrary web script or HTML via the…
CVE-2017-9441 - CVSS 5.4 (medium), 2017-06-05: Multiple cross-site scripting (XSS) vulnerabilities in BigTree CMS through 4.2.18 allow remote authenticated users to inject arbitrary web script or HTML by…
CVE-2017-9444 - CVSS 8.8 (high), 2017-06-05: BigTree CMS through 4.2.18 has CSRF related to the core\admin\modules\users\profile\update.php script (modify user information), the…
CVE-2017-9443 - CVSS 8.8 (high), 2017-06-05: BigTree CMS through 4.2.18 allows remote authenticated users to conduct SQL injection attacks via a crafted tables object in manifest.json in an uploaded…
CVE-2017-9442 - CVSS 8.8 (high), 2017-06-05: BigTree CMS through 4.2.18 allows remote authenticated users to execute arbitrary code by uploading a crafted package containing a PHP web shell, related to…
CVE-2017-9428 - CVSS 7.5 (high), 2017-06-04: A directory traversal vulnerability exists in core\admin\ajax\developer\extensions\file-browser.php in BigTree CMS through 4.2.18 on Windows, allowing…
CVE-2017-9427 - CVSS 8.8 (high), 2017-06-04: SQL injection vulnerability in BigTree CMS through 4.2.18 allows remote authenticated users to execute arbitrary SQL commands via…
CVE-2017-9378 - CVSS 6.5 (medium), 2017-06-02: BigTree CMS through 4.2.18 does not prevent a user from deleting their own account. This could have security relevance because deletion was supposed to be an…