Thinkadmin - vulnerabilities (CVEs)

9 CVEs in 1 products, 0 in the last 30 days, newest from 2024-11-04.

Products

• Thinkadmin - 9 CVEs

Newest CVEs of Thinkadmin

• CVE-2024-10749 - CVSS 8.1 (high), 2024-11-04: A vulnerability, which was classified as critical, was found in ThinkAdmin up to 6.1.67. Affected is the function script of the file…
• CVE-2023-48965 - CVSS 8.8 (high), 2023-12-04: An issue in the component /admin/api.plugs/script of ThinkAdmin v6.1.53 allows attackers to getshell via providing a crafted URL to download a malicious PHP…
• CVE-2023-48966 - CVSS 8.8 (high), 2023-12-04: An arbitrary file upload vulnerability in the component /admin/api.upload/file of ThinkAdmin v6.1.53 allows attackers to execute arbitrary code via a crafted…
• CVE-2023-34833 - CVSS 6.1 (medium), 2023-06-15: An arbitrary file upload vulnerability in the component /api/upload.php of ThinkAdmin v6 allows attackers to execute arbitrary code via a crafted file.
• CVE-2020-35296 - CVSS 7.5 (high), 2021-03-03: ThinkAdmin v6 has default administrator credentials, which allows attackers to gain unrestricted administratior dashboard access.
• CVE-2020-23653 - CVSS 9.8 (critical), 2021-01-13: An insecure unserialize vulnerability was discovered in ThinkAdmin versions 4.x through 6.x in app/admin/controller/api/Update.php and…
• CVE-2020-29315 - CVSS 5.4 (medium), 2020-12-01: ThinkAdmin version v1 v6 has a stored XSS vulnerability which allows remote attackers to inject an arbitrary web script or HTML.
• CVE-2020-25540 - CVSS 7.5 (high), 2020-09-14: ThinkAdmin v6 is affected by a directory traversal vulnerability. An unauthorized attacker can read arbitrarily file on a remote server via GET request encode…
• CVE-2019-11018 - CVSS 9.8 (critical), 2019-04-08: application\admin\controller\User.php in ThinkAdmin V4.0 does not prevent continued use of an administrator's cookie-based credentials after a password change.