Vulnerabilities > Thinkcmf

DATE CVE VULNERABILITY TITLE RISK
2018-12-06 CVE-2018-19896 SQL Injection vulnerability in Thinkcmf X2.2.2
ThinkCMF X2.2.2 has SQL Injection via the function delete() in SlideController.class.php and is exploitable with the manager privilege via the ids[] parameter in a slide action.
network
low complexity
thinkcmf CWE-89
6.5
6.5
2018-12-06 CVE-2018-19895 SQL Injection vulnerability in Thinkcmf X2.2.2
ThinkCMF X2.2.2 has SQL Injection via the function edit_post() in NavController.class.php and is exploitable with the manager privilege via the parentid parameter in a nav action.
network
low complexity
thinkcmf CWE-89
6.5
6.5
2018-12-06 CVE-2018-19894 SQL Injection vulnerability in Thinkcmf X2.2.2
ThinkCMF X2.2.2 has SQL Injection via the functions check() and delete() in CommentadminController.class.php and is exploitable with the manager privilege via the ids[] parameter in a commentadmin action.
network
low complexity
thinkcmf CWE-89
6.5
6.5
2018-08-30 CVE-2018-16141 Path Traversal vulnerability in Thinkcmf Thinkcmfx X2.2.3
ThinkCMF X2.2.3 has an arbitrary file deletion vulnerability in do_avatar in \application\User\Controller\ProfileController.class.php via an imgurl parameter with a ..\ sequence.
network
low complexity
thinkcmf CWE-22
5.5
5.5