Vulnerabilities > Blackcat CMS

DATE CVE VULNERABILITY TITLE RISK
2017-08-31 CVE-2017-14050 Unrestricted Upload of File with Dangerous Type vulnerability in Blackcat-Cms Blackcat CMS 1.2
In BlackCat CMS 1.2, backend/addons/install.php allows remote authenticated users to execute arbitrary PHP code via a ZIP archive that contains a .php file.
network
low complexity
blackcat-cms CWE-434
6.5
2017-08-31 CVE-2017-14049 Cross-site Scripting vulnerability in Blackcat-Cms Blackcat CMS 1.2
In BlackCat CMS 1.2, backend/settings/ajax_save_settings.php allows remote authenticated users to conduct XSS attacks via the Website header or Website footer field.
3.5
2017-08-31 CVE-2017-14048 Cross-Site Request Forgery (CSRF) vulnerability in Blackcat-Cms Blackcat CMS 1.2
BlackCat CMS 1.2 allows remote authenticated users to inject arbitrary PHP code into info.php via a crafted new_modulename parameter to backend/addons/ajax_create.php.
network
low complexity
blackcat-cms CWE-352
6.5
2017-08-31 CVE-2017-13670 Unspecified vulnerability in Blackcat-Cms Blackcat CMS 1.2
In BlackCat CMS 1.2, remote authenticated users can upload any file via the media upload function in backend/media/ajax_upload.php, as demonstrated by a ZIP archive that contains a .php file.
network
low complexity
blackcat-cms
4.0
2017-07-17 CVE-2017-9609 Cross-site Scripting vulnerability in Blackcat-Cms Blackcat CMS 1.2
Cross-site scripting (XSS) vulnerability in Blackcat CMS 1.2 allows remote authenticated users to inject arbitrary web script or HTML via the map_language parameter to backend/pages/lang_settings.php.
3.5
2015-07-14 CVE-2015-5521 Cross-site Scripting vulnerability in Blackcat-Cms Blackcat CMS 1.1.2
Cross-site scripting (XSS) vulnerability in BlackCat CMS 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the name in a new group to backend/groups/index.php.
network
low complexity
blackcat-cms CWE-79
4.8
2014-09-12 CVE-2014-5259 Cross-Site Scripting vulnerability in Blackcat-Cms Blackcat CMS 1.0/1.0.1/1.0.2
Cross-site scripting (XSS) vulnerability in cattranslate.php in the CatTranslate JQuery plugin in BlackCat CMS 1.0.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the msg parameter.
4.3