Bluecms_project Bluecms
12 CVEs affecting Bluecms_project Bluecms. Latest disclosed: 2025-04-10. Critical: 9, High: 0.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-33734 | Critical | 9.8 | 2023-05-30 | BlueCMS v1.6 was discovered to contain a SQL injection vulnerability via the keywords parameter at search.php. |
CVE-2022-37113 | Critical | 9.8 | 2022-08-23 | Bluecms 1.6 has SQL injection in line 132 of admin/area.php |
CVE-2022-37112 | Critical | 9.8 | 2022-08-23 | BlueCMS 1.6 has SQL injection in line 55 of admin/model.php |
CVE-2022-37111 | Critical | 9.8 | 2022-08-23 | BlueCMS 1.6 has SQL injection in line 132 of admin/article.php |
CVE-2022-27962 | Critical | 9.8 | 2022-05-03 | Bluecms 1.6 has a SQL injection vulnerability at cooike. |
CVE-2020-19853 | Critical | 9.8 | 2021-09-08 | BlueCMS v1.6 contains a SQL injection vulnerability via /ad_js.php. |
CVE-2019-10262 | Critical | 9.8 | 2019-03-28 | A SQL Injection issue was discovered in BlueCMS 1.6. The variable $ad_id is spliced directly in uploads/admin/ad.php in the admin folder, and is not wrapped in… |
CVE-2019-9594 | Critical | 9.8 | 2019-03-06 | BlueCMS 1.6 allows SQL Injection via the user_id parameter in an uploads/admin/user.php?act=edit request. |
CVE-2018-16432 | Critical | 9.8 | 2018-09-04 | BlueCMS 1.6 allows SQL Injection via the user_name parameter to uploads/user.php?act=index_login. |
CVE-2024-45894 | Medium | 4.9 | 2024-10-07 | BlueCMS 1.6 suffers from Arbitrary File Deletion via the file_name parameter in an /admin/database.php?act=del request. |
CVE-2025-29150 | Medium | 4.3 | 2025-04-10 | BlueCMS 1.6 suffers from Arbitrary File Deletion via the id parameter in an /publish.php?act=del request. |
CVE-2010-4897 | | 2011-10-08 | SQL injection vulnerability in comment.php in BlueCMS 1.6 allows remote attackers to execute arbitrary SQL commands via the X-Forwarded-For HTTP header in a se… |