Croogo

13 CVEs across 2 Croogo products. Browse Croogo vulnerabilities, severities, and proof-of-concept exploits.

Croogo products with known CVEs

ProductCVEs
Croogo12
Cms1
Croogo CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-16219Medium6.32026-07-19A flaw has been found in Croogo CMS up to 4.0.7. This affects the function FileManager::isEditable of the file FileManager/src/Utility/FileManager.php of the c…
CVE-2024-42718Medium6.52025-12-26A path traversal vulnerability in Croogo CMS 4.0.7 allows remote attackers to read arbitrary files via a specially crafted path in the 'edit-file' parameter.
CVE-2024-29643Critical9.12025-04-18An issue in croogo v.3.0.2 allows an attacker to perform Host header injection via the feed.rss component.
CVE-2021-44673High8.82022-03-10A Remote Code Execution (RCE) vulnerability exists in Croogo 3.0.2via admin/file-manager/attachments, which lets a malicoius user upload a web shell script.
CVE-2019-20789Medium4.82020-04-26Croogo before 3.0.7 allows XSS via the title to admin/menus/menus or admin/taxonomy/vocabularies.
CVE-2019-7173Medium4.82019-01-29A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /admin/file-manager/a…
CVE-2019-7171Medium4.82019-01-29A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /admin/blocks/blocks/…
CVE-2019-7170Medium4.82019-01-29A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /admin/taxonomy/vocab…
CVE-2019-7169Medium4.82019-01-29A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /admin/menus/menus/ed…
CVE-2019-7168Medium4.82019-01-29A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Blog field to /admin/nodes/nodes/add…
CVE-2017-1000510Medium5.42018-02-09Croogo version 2.3.1-17-g6f82e6c contains a Cross Site Scripting (XSS) vulnerability in Page name that can result in execution of javascript code.
CVE-2015-10532015-01-16Cross-site scripting (XSS) vulnerability in the administrative backend in Croogo before 2.2.1 allows remote attackers to inject arbitrary web script or HTML vi…
CVE-2014-85772014-10-31Multiple cross-site scripting (XSS) vulnerabilities in Croogo before 2.1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) data[Conta…