Bigtreecms Bigtree Cms
44 CVEs affecting Bigtreecms Bigtree Cms. Latest disclosed: 2023-11-01. Critical: 3, High: 15.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-10574 | Critical | 9.8 | 2018-04-30 | site/index.php/admin/trees/add/ in BigTree 4.2.22 and earlier allows remote attackers to upload and execute arbitrary PHP code because the BigTreeStorage class… |
CVE-2017-9364 | Critical | 9.8 | 2017-06-02 | Unrestricted File Upload exists in BigTree CMS through 4.2.18: if an attacker uploads an 'xxx.pht' or 'xxx.phtml' file, they could bypass a safety check and ex… |
CVE-2017-7695 | Critical | 9.8 | 2017-04-11 | Unrestricted File Upload exists in BigTree CMS before 4.2.17: if an attacker uploads an 'xxx.php[space]' file, they could bypass a safety check and execute any… |
CVE-2020-26670 | High | 8.8 | 2021-06-01 | A vulnerability has been discovered in BigTree CMS 4.4.10 and earlier which allows an authenticated attacker to execute arbitrary commands through a crafted re… |
CVE-2020-26668 | High | 8.8 | 2021-06-01 | A SQL injection vulnerability was discovered in /core/feeds/custom.php in BigTree CMS 4.4.10 and earlier which allows an authenticated attacker to inject a mal… |
CVE-2017-11736 | High | 8.8 | 2017-07-29 | SQL injection vulnerability in core\admin\auto-modules\forms\process.php in BigTree 4.2.18 allows remote authenticated users to execute arbitrary SQL commands… |
CVE-2017-9449 | High | 8.8 | 2017-06-06 | SQL injection vulnerability in BigTree CMS through 4.2.18 allows remote authenticated users to execute arbitrary SQL commands via core/admin/modules/developer/… |
CVE-2017-9444 | High | 8.8 | 2017-06-05 | BigTree CMS through 4.2.18 has CSRF related to the core\admin\modules\users\profile\update.php script (modify user information), the index.php/admin/developer/… |
CVE-2017-9443 | High | 8.8 | 2017-06-05 | BigTree CMS through 4.2.18 allows remote authenticated users to conduct SQL injection attacks via a crafted tables object in manifest.json in an uploaded packa… |
CVE-2017-9442 | High | 8.8 | 2017-06-05 | BigTree CMS through 4.2.18 allows remote authenticated users to execute arbitrary code by uploading a crafted package containing a PHP web shell, related to ex… |
CVE-2017-9427 | High | 8.8 | 2017-06-04 | SQL injection vulnerability in BigTree CMS through 4.2.18 allows remote authenticated users to execute arbitrary SQL commands via core\admin\modules\developer\… |
CVE-2017-9379 | High | 8.8 | 2017-06-02 | Multiple CSRF issues exist in BigTree CMS through 4.2.18 - the clear parameter to core\admin\modules\dashboard\vitals-statistics\404\clear.php and the from or… |
CVE-2017-9365 | High | 8.8 | 2017-06-02 | CSRF exists in BigTree CMS through 4.2.18 with the force parameter to /admin/pages/revisions.php - for example: /admin/pages/revisions/1/?force=false. A page w… |
CVE-2017-7881 | High | 8.8 | 2017-04-15 | BigTree CMS through 4.2.17 relies on a substring check for CSRF protection, which allows remote attackers to bypass this check by placing the required admin/de… |
CVE-2018-17341 | High | 8.1 | 2018-09-23 | BigTree 4.2.23 on Windows, when Advanced or Simple Rewrite routing is enabled, allows remote attackers to bypass authentication via a ..\ substring, as demonst… |
CVE-2018-17030 | High | 7.5 | 2018-09-14 | BigTree CMS 4.2.23 allows remote authenticated users, if possessing privileges to set hooks, to execute arbitrary code via /core/admin/auto-modules/forms/proce… |
CVE-2017-9428 | High | 7.5 | 2017-06-04 | A directory traversal vulnerability exists in core\admin\ajax\developer\extensions\file-browser.php in BigTree CMS through 4.2.18 on Windows, allowing attacker… |
CVE-2017-6914 | High | 7.1 | 2017-03-15 | CSRF exists in BigTree CMS 4.1.18 and 4.2.16 with the id parameter to the admin/ajax/users/delete/ page. A user can be deleted. |
CVE-2017-16961 | Medium | 6.5 | 2017-11-27 | A SQL injection vulnerability in core/inc/auto-modules.php in BigTree CMS through 4.2.19 allows remote authenticated attackers to obtain information in the con… |
CVE-2017-9378 | Medium | 6.5 | 2017-06-02 | BigTree CMS through 4.2.18 does not prevent a user from deleting their own account. This could have security relevance because deletion was supposed to be an a… |