TextPattern 4.8.4

CPE Details

TextPattern 4.8.4
textpattern
textpattern
4.8.4
2021-02-01
11h50 +00:00
2021-02-01
11h50 +00:00
CPE NVD
Alerte pour un CPE
Restez informé de toutes modifications pour un CPE spécifique.
Gestion des notifications

CPE Name: cpe:2.3:a:textpattern:textpattern:4.8.4:*:*:*:*:*:*:*

Informations

Vendor

textpattern

Product

textpattern

Version

4.8.4

Related CVE

Open and find in CVE List

CVE ID Publié Description Score Gravité
CVE-2023-26852 2023-04-12 00h00 +00:00 An arbitrary file upload vulnerability in the upload plugin of Textpattern v4.8.8 and below allows attackers to execute arbitrary code by uploading a crafted PHP file.
7.2
Haute
CVE-2021-40642 2022-06-29 08h25 +00:00 Textpattern CMS v4.8.7 and older vulnerability exists through Sensitive Cookie in HTTPS Session Without 'Secure' Attribute via textpattern/lib/txplib_misc.php. The secure flag is not set for txp_login session cookie in the application. If the secure flag is not set, then the cookie will be transmitted in clear-text if the user visits any HTTP URLs within the cookie's scope. An attacker may be able to induce this event by feeding a user suitable links, either directly or via another web site.
4.3
Moyen
CVE-2021-28001 2021-08-19 11h50 +00:00 A cross-site scripting vulnerability was discovered in the Comments parameter in Textpattern CMS 4.8.4 which allows remote attackers to execute arbitrary code via a crafted payload entered into the URL field. The vulnerability is triggered by users visiting https://site.com/articles/welcome-to-your-site#comments-head.
5.4
Moyen
CVE-2021-30209 2021-04-15 11h14 +00:00 Textpattern V4.8.4 contains an arbitrary file upload vulnerability where a plug-in can be loaded in the background without any security verification, which may lead to obtaining system permissions.
6.5
Moyen
CVE-2020-35854 2021-01-25 13h41 +00:00 Textpattern 4.8.4 is affected by cross-site scripting (XSS) in the Body parameter.
4.8
Moyen