Vulnerabilities > Bigtreecms > Bigtree CMS > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2023-11-01 | CVE-2023-44954 | Cross-site Scripting vulnerability in Bigtreecms Bigtree CMS 4.5.7 Cross Site Scripting vulnerability in BigTree CMS v.4.5.7 allows a remote attacker to execute arbitrary code via the ID parameter in the Developer Settings functions. | 5.4 |
| 2021-06-01 | CVE-2020-26668 | SQL Injection vulnerability in Bigtreecms Bigtree CMS A SQL injection vulnerability was discovered in /core/feeds/custom.php in BigTree CMS 4.4.10 and earlier which allows an authenticated attacker to inject a malicious SQL query to the applications via the 'Create New Feed' function. | 6.5 |
| 2021-06-01 | CVE-2020-26670 | OS Command Injection vulnerability in Bigtreecms Bigtree CMS A vulnerability has been discovered in BigTree CMS 4.4.10 and earlier which allows an authenticated attacker to execute arbitrary commands through a crafted request sent to the server via the 'Create a New Setting' function. | 6.5 |
| 2018-10-19 | CVE-2018-18380 | Session Fixation vulnerability in Bigtreecms Bigtree CMS A Session Fixation issue was discovered in Bigtree before 4.2.24. | 5.8 |
| 2018-10-16 | CVE-2018-18308 | Cross-site Scripting vulnerability in Bigtreecms Bigtree CMS 4.2.23 In the 4.2.23 version of BigTree, a Stored XSS vulnerability has been discovered in /admin/ajax/file-browser/upload/ (aka the image upload area). | 4.3 |
| 2018-09-23 | CVE-2018-17341 | Improper Authentication vulnerability in Bigtreecms Bigtree CMS 4.2.23 BigTree 4.2.23 on Windows, when Advanced or Simple Rewrite routing is enabled, allows remote attackers to bypass authentication via a ..\ substring, as demonstrated by a launch.php?bigtree_htaccess_url=admin/images/..\ URI. | 6.8 |
| 2018-09-14 | CVE-2018-17030 | Code Injection vulnerability in Bigtreecms Bigtree CMS 4.2.23 BigTree CMS 4.2.23 allows remote authenticated users, if possessing privileges to set hooks, to execute arbitrary code via /core/admin/auto-modules/forms/process.php. | 6.0 |
| 2018-06-26 | CVE-2018-1000521 | Cross-site Scripting vulnerability in Bigtreecms Bigtree CMS 4.2.21 BigTree-CMS contains a Cross Site Scripting (XSS) vulnerability in /users/create that can result in The low-privileged users can use this vulnerability to attack high-privileged(Developer) users.. | 4.3 |
| 2018-04-17 | CVE-2018-10183 | Cross-site Scripting vulnerability in Bigtreecms Bigtree CMS 4.2.22 An issue was discovered in BigTree 4.2.22. | 4.3 |
| 2017-11-27 | CVE-2017-16961 | SQL Injection vulnerability in Bigtreecms Bigtree CMS A SQL injection vulnerability in core/inc/auto-modules.php in BigTree CMS through 4.2.19 allows remote authenticated attackers to obtain information in the context of the user used by the application to retrieve data from the database. | 4.0 |