BigTree CMS BigTree CMS 4.2.21

CPE Details

BigTree CMS BigTree CMS 4.2.21
bigtreecms
bigtree_cms
4.2.21
2019-05-14
16h22 +00:00
2019-05-14
16h22 +00:00
CPE NVD
Alerte pour un CPE
Stay informed of any changes for a specific CPE.
Notifications manage

CPE Name: cpe:2.3:a:bigtreecms:bigtree_cms:4.2.21:*:*:*:*:*:*:*

Informations

Vendor

bigtreecms

Product

bigtree_cms

Version

4.2.21

Related CVE

Open and find in CVE List

CVE ID Published Description Score Severity
CVE-2020-26670 2021-06-01 12h13 +00:00 A vulnerability has been discovered in BigTree CMS 4.4.10 and earlier which allows an authenticated attacker to execute arbitrary commands through a crafted request sent to the server via the 'Create a New Setting' function.
8.8
High
CVE-2020-26669 2021-06-01 12h13 +00:00 A stored cross-site scripting (XSS) vulnerability was discovered in BigTree CMS 4.4.10 and earlier which allows an authenticated attacker to execute arbitrary web scripts or HTML via the page content to site/index.php/admin/pages/update.
5.4
Medium
CVE-2020-26668 2021-06-01 12h13 +00:00 A SQL injection vulnerability was discovered in /core/feeds/custom.php in BigTree CMS 4.4.10 and earlier which allows an authenticated attacker to inject a malicious SQL query to the applications via the 'Create New Feed' function.
8.8
High
CVE-2018-18380 2018-10-19 18h00 +00:00 A Session Fixation issue was discovered in Bigtree before 4.2.24. admin.php accepts a user-provided PHP session ID instead of regenerating a new one after a user has logged in to the application. The Session Fixation could allow an attacker to hijack an admin session.
5.4
Medium
CVE-2018-1000521 2018-06-26 14h00 +00:00 BigTree-CMS contains a Cross Site Scripting (XSS) vulnerability in /users/create that can result in The low-privileged users can use this vulnerability to attack high-privileged(Developer) users.. This attack appear to be exploitable via no. This vulnerability appears to have been fixed in after commit b652cfdc14d0670c81ac4401ad5a04376745c279.
6.1
Medium
CVE-2018-10574 2018-04-30 20h00 +00:00 site/index.php/admin/trees/add/ in BigTree 4.2.22 and earlier allows remote attackers to upload and execute arbitrary PHP code because the BigTreeStorage class in core/inc/bigtree/apis/storage.php does not prevent uploads of .htaccess files.
9.8
Critical
CVE-2018-10364 2018-04-30 19h00 +00:00 BigTree before 4.2.22 has XSS in the Users management page via the name or company field.
5.4
Medium