Vulnerabilities > Thinkcmf > High
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2022-12-01 | CVE-2022-40489 | Cross-Site Request Forgery (CSRF) vulnerability in Thinkcmf 6.0.7 ThinkCMF version 6.0.7 is affected by a Cross Site Request Forgery (CSRF) vulnerability that allows a Super Administrator user to be injected into administrative users. | 8.8 |
| 2019-02-07 | CVE-2019-7580 | Code Injection vulnerability in Thinkcmf 5.0.190111 ThinkCMF 5.0.190111 allows remote attackers to execute arbitrary PHP code via the portal/admin_category/addpost.html alias parameter because the mishandling of a single quote character allows data/conf/route.php injection. | 8.8 |
| 2018-12-06 | CVE-2018-19898 | SQL Injection vulnerability in Thinkcmf X2.2.2 ThinkCMF X2.2.2 has SQL Injection via the method edit_post in ArticleController.class.php and is exploitable by normal authenticated users via the post[id][1] parameter in an article edit_post action. | 8.8 |
| 2018-12-06 | CVE-2018-19897 | SQL Injection vulnerability in Thinkcmf X2.2.2 ThinkCMF X2.2.2 has SQL Injection via the function _listorders() in AdminbaseController.class.php and is exploitable with the manager privilege via the listorders[key][1] parameter in a Link listorders action. | 7.2 |
| 2018-12-06 | CVE-2018-19896 | SQL Injection vulnerability in Thinkcmf X2.2.2 ThinkCMF X2.2.2 has SQL Injection via the function delete() in SlideController.class.php and is exploitable with the manager privilege via the ids[] parameter in a slide action. | 7.2 |
| 2018-12-06 | CVE-2018-19895 | SQL Injection vulnerability in Thinkcmf X2.2.2 ThinkCMF X2.2.2 has SQL Injection via the function edit_post() in NavController.class.php and is exploitable with the manager privilege via the parentid parameter in a nav action. | 7.2 |
| 2018-12-06 | CVE-2018-19894 | SQL Injection vulnerability in Thinkcmf X2.2.2 ThinkCMF X2.2.2 has SQL Injection via the functions check() and delete() in CommentadminController.class.php and is exploitable with the manager privilege via the ids[] parameter in a commentadmin action. | 7.2 |