Vulnerabilities > Bigtreecms > Bigtree CMS > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2017-03-15 | CVE-2017-6918 | Cross-Site Request Forgery (CSRF) vulnerability in Bigtreecms Bigtree CMS 4.2.16 CSRF exists in BigTree CMS 4.2.16 with the value[#][*] parameter to the admin/settings/update/ page. | 4.3 |
| 2017-03-15 | CVE-2017-6917 | Cross-Site Request Forgery (CSRF) vulnerability in Bigtreecms Bigtree CMS 4.2.16 CSRF exists in BigTree CMS 4.2.16 with the value parameter to the admin/settings/update/ page. | 4.3 |
| 2017-03-15 | CVE-2017-6916 | Cross-Site Request Forgery (CSRF) vulnerability in Bigtreecms Bigtree CMS 4.1.8 CSRF exists in BigTree CMS 4.1.18 with the nav-social[#] parameter to the admin/settings/update/ page. | 4.3 |
| 2017-03-15 | CVE-2017-6915 | Cross-Site Request Forgery (CSRF) vulnerability in Bigtreecms Bigtree CMS 4.1.8 CSRF exists in BigTree CMS 4.1.18 with the colophon parameter to the admin/settings/update/ page. | 4.3 |
| 2017-03-15 | CVE-2017-6914 | Cross-Site Request Forgery (CSRF) vulnerability in Bigtreecms Bigtree CMS 4.1.8/4.2.16 CSRF exists in BigTree CMS 4.1.18 and 4.2.16 with the id parameter to the admin/ajax/users/delete/ page. | 5.8 |
| 2013-08-19 | CVE-2013-5313 | Cross-Site Request Forgery (CSRF) vulnerability in Bigtreecms Bigtree CMS 4.0 Cross-site request forgery (CSRF) vulnerability in core/admin/modules/users/update.php in BigTree CMS 4.0 RC2 and earlier allows remote attackers to hijack the authentication of administrators for requests that modify arbitrary user accounts via an edit user action. | 6.8 |
| 2013-08-19 | CVE-2013-4881 | Cross-Site Request Forgery (CSRF) vulnerability in Bigtreecms Bigtree CMS 4.0 Cross-site request forgery (CSRF) vulnerability in core/admin/modules/users/create.php in BigTree CMS 4.0 RC2 and earlier allows remote attackers to hijack the authentication of administrators for requests that create an administrative user via an add user action to index.php. | 6.8 |
| 2013-08-14 | CVE-2013-4880 | Cross-Site Scripting vulnerability in Bigtreecms Bigtree CMS 4.0 Cross-site scripting (XSS) vulnerability in core/admin/modules/developer/modules/views/add.php in BigTree CMS 4.0 RC2 and earlier allows remote attackers to inject arbitrary web script or HTML via the module parameter. | 4.3 |