Vulnerabilities > Bigtreecms

DATE CVE VULNERABILITY TITLE RISK
2021-08-26 CVE-2020-18467 Cross-site Scripting vulnerability in Bigtreecms Bigtree CMS 4.4.3
Cross Site Scripting (XSS) vulnerabilty exists in BigTree-CMS 4.4.3 in the tag name field found in the Tags page under the General menu via a crafted website name by doing an authenticated POST HTTP request to admin/tags/create.
network
bigtreecms CWE-79
3.5
2021-06-01 CVE-2020-26668 SQL Injection vulnerability in Bigtreecms Bigtree CMS
A SQL injection vulnerability was discovered in /core/feeds/custom.php in BigTree CMS 4.4.10 and earlier which allows an authenticated attacker to inject a malicious SQL query to the applications via the 'Create New Feed' function.
network
low complexity
bigtreecms CWE-89
6.5
2021-06-01 CVE-2020-26669 Cross-site Scripting vulnerability in Bigtreecms Bigtree CMS
A stored cross-site scripting (XSS) vulnerability was discovered in BigTree CMS 4.4.10 and earlier which allows an authenticated attacker to execute arbitrary web scripts or HTML via the page content to site/index.php/admin/pages/update.
network
bigtreecms CWE-79
3.5
2021-06-01 CVE-2020-26670 Command Injection vulnerability in Bigtreecms Bigtree CMS
A vulnerability has been discovered in BigTree CMS 4.4.10 and earlier which allows an authenticated attacker to execute arbitrary commands through a crafted request sent to the server via the 'Create a New Setting' function.
network
low complexity
bigtreecms CWE-77
6.5
2018-12-23 CVE-2018-20405 Authorization Bypass Through User-Controlled Key vulnerability in Bigtreecms Bigtree 4.3
** DISPUTED ** BigTree 4.3 allows full path disclosure via authenticated admin/news/ input that triggers a syntax error.
network
low complexity
bigtreecms CWE-639
4.0
2018-10-19 CVE-2018-18380 Session Fixation vulnerability in Bigtreecms Bigtree CMS
A Session Fixation issue was discovered in Bigtree before 4.2.24.
5.8
2018-10-16 CVE-2018-18308 Cross-site Scripting vulnerability in Bigtreecms Bigtree CMS 4.2.23
In the 4.2.23 version of BigTree, a Stored XSS vulnerability has been discovered in /admin/ajax/file-browser/upload/ (aka the image upload area).
network
bigtreecms CWE-79
4.3
2018-09-23 CVE-2018-17341 Improper Authentication vulnerability in Bigtreecms Bigtree CMS 4.2.23
BigTree 4.2.23 on Windows, when Advanced or Simple Rewrite routing is enabled, allows remote attackers to bypass authentication via a ..\ substring, as demonstrated by a launch.php?bigtree_htaccess_url=admin/images/..\ URI.
6.8
2018-09-14 CVE-2018-17030 Code Injection vulnerability in Bigtreecms Bigtree CMS 4.2.23
BigTree CMS 4.2.23 allows remote authenticated users, if possessing privileges to set hooks, to execute arbitrary code via /core/admin/auto-modules/forms/process.php.
network
bigtreecms CWE-94
6.0
2018-06-26 CVE-2018-1000521 Cross-site Scripting vulnerability in Bigtreecms Bigtree CMS 4.2.21
BigTree-CMS contains a Cross Site Scripting (XSS) vulnerability in /users/create that can result in The low-privileged users can use this vulnerability to attack high-privileged(Developer) users..
network
bigtreecms CWE-79
4.3