4.3.2

DATE	CVE	VULNERABILITY TITLE	RISK
2021-06-01	CVE-2020-26668	SQL Injection vulnerability in Bigtreecms Bigtree CMS A SQL injection vulnerability was discovered in /core/feeds/custom.php in BigTree CMS 4.4.10 and earlier which allows an authenticated attacker to inject a malicious SQL query to the applications via the 'Create New Feed' function. network low complexity bigtreecms CWE-89	6.5
2021-06-01	CVE-2020-26669	Cross-site Scripting vulnerability in Bigtreecms Bigtree CMS A stored cross-site scripting (XSS) vulnerability was discovered in BigTree CMS 4.4.10 and earlier which allows an authenticated attacker to execute arbitrary web scripts or HTML via the page content to site/index.php/admin/pages/update. network bigtreecms CWE-79	3.5
2021-06-01	CVE-2020-26670	OS Command Injection vulnerability in Bigtreecms Bigtree CMS A vulnerability has been discovered in BigTree CMS 4.4.10 and earlier which allows an authenticated attacker to execute arbitrary commands through a crafted request sent to the server via the 'Create a New Setting' function. network low complexity bigtreecms CWE-78	6.5