Vulnerabilities > Thinkcmf
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2018-12-06 | CVE-2018-19896 | SQL Injection vulnerability in Thinkcmf X2.2.2 ThinkCMF X2.2.2 has SQL Injection via the function delete() in SlideController.class.php and is exploitable with the manager privilege via the ids[] parameter in a slide action. | 7.2 |
| 2018-12-06 | CVE-2018-19895 | SQL Injection vulnerability in Thinkcmf X2.2.2 ThinkCMF X2.2.2 has SQL Injection via the function edit_post() in NavController.class.php and is exploitable with the manager privilege via the parentid parameter in a nav action. | 7.2 |
| 2018-12-06 | CVE-2018-19894 | SQL Injection vulnerability in Thinkcmf X2.2.2 ThinkCMF X2.2.2 has SQL Injection via the functions check() and delete() in CommentadminController.class.php and is exploitable with the manager privilege via the ids[] parameter in a commentadmin action. | 7.2 |
| 2018-08-30 | CVE-2018-16141 | Path Traversal vulnerability in Thinkcmf Thinkcmfx X2.2.3 ThinkCMF X2.2.3 has an arbitrary file deletion vulnerability in do_avatar in \application\User\Controller\ProfileController.class.php via an imgurl parameter with a ..\ sequence. | 6.5 |