Jan Syski Megabip
11 CVEs affecting Jan Syski Megabip. Latest disclosed: 2025-05-23. Critical: 3, High: 1.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-1659 | Critical | 9.8 | 2024-06-12 | Arbitrary File Upload vulnerability in MegaBIP software allows attacker to upload any file to the server (including a PHP code file) without an authentication… |
CVE-2024-1577 | Critical | 9.8 | 2024-06-12 | Remote Code Execution vulnerability in MegaBIP software allows to execute arbitrary code on the server without requiring authentication by saving crafted by th… |
CVE-2024-1576 | Critical | 9.8 | 2024-06-12 | SQL Injection vulnerability in MegaBIP software allows attacker to obtain site administrator privileges, including access to the administration panel and the a… |
CVE-2023-5378 | High | 8.8 | 2024-01-29 | Improper Input Validation vulnerability in MegaBIP and already unsupported SmodBIP software allows for Stored XSS.This issue affects SmodBIP in all versions a… |
CVE-2025-3895 | | 2025-05-23 | Token used for resetting passwords in MegaBIP software are generated using a small space of random values combined with a queryable value. It allows an unauth… | |
CVE-2025-3894 | | 2025-05-23 | Text editor embedded into MegaBIP software does not neutralize user input allowing Stored XSS attacks on other users. In order to use the editor high privilege… | |
CVE-2025-3893 | | 2025-05-23 | While editing pages managed by MegaBIP a user with high privileges is prompted to give a reasoning for performing this action. Input provided by the the user i… | |
CVE-2024-6880 | | 2025-01-10 | During MegaBIP installation process, a user is encouraged to change a default path to administrative portal, as keeping it secret is listed by the author as on… | |
CVE-2024-6662 | | 2025-01-10 | Websites managed by MegaBIP in versions below 5.15 are vulnerable to Cross-Site Request Forgery (CSRF) as the form available under "/edytor/index.php?id=7,7,0"… | |
CVE-2024-6527 | | 2024-07-09 | SQL Injection vulnerability in parameter "w" in file "druk.php" in MegaBIP software allows unauthorized attacker to disclose the contents of the database and o… | |
CVE-2024-6160 | | 2024-06-24 | SQL Injection vulnerability in MegaBIP software allows attacker to disclose the contents of the database, obtain session cookies or modify the content of pages… |