Thinksaas Thinksaas
12 CVEs affecting Thinksaas Thinksaas. Latest disclosed: 2024-07-21. Critical: 2, High: 0.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-40456 | Critical | 9.8 | 2024-07-16 | ThinkSAAS v3.7.0 was discovered to contain a SQL injection vulnerability via the name parameter at \system\action\update.php. |
CVE-2020-35337 | Critical | 9.8 | 2021-03-24 | ThinkSAAS before 3.38 contains a SQL injection vulnerability through app/topic/action/admin/topic.php via the title parameter, which allows remote attackers to… |
CVE-2024-33101 | Medium | 6.1 | 2024-04-30 | A stored cross-site scripting (XSS) vulnerability in the component /action/anti.php of ThinkSAAS v3.7.0 allows attackers to execute arbitrary web scripts or HT… |
CVE-2019-16665 | Medium | 6.1 | 2019-09-21 | An issue was discovered in ThinkSAAS 2.91. There is XSS via the content to the index.php?app=group&ac=comment&ts=do&js=1 URI, as demonstrated by a crafted SVG… |
CVE-2024-33102 | Medium | 5.4 | 2024-04-30 | A stored cross-site scripting (XSS) vulnerability in the component /pubs/counter.php of ThinkSAAS v3.7.0 allows attackers to execute arbitrary web scripts or H… |
CVE-2018-15130 | Medium | 5.4 | 2018-08-07 | ThinkSAAS through 2018-07-25 has XSS via the index.php?app=group&ac=create&ts=do groupdesc parameter. |
CVE-2018-15129 | Medium | 5.4 | 2018-08-07 | ThinkSAAS through 2018-07-25 has XSS via the index.php?app=article&ac=comment&ts=do content parameter. |
CVE-2020-18741 | Medium | 5.3 | 2021-07-08 | Improper Authorization in ThinkSAAS v2.7 allows remote attackers to modify the description of any user's photo via the "photoid%5B%5D" and "photodesc%5B%5D" pa… |
CVE-2019-16664 | Medium | 4.8 | 2019-09-21 | An issue was discovered in ThinkSAAS 2.91. There is XSS via the index.php?app=group&ac=create&ts=do groupname parameter. |
CVE-2024-6942 | Low | 3.5 | 2024-07-21 | A vulnerability, which was classified as problematic, was found in ThinkSAAS 3.7.0. Affected is an unknown function of the file app/system/action/anti.php of t… |
CVE-2024-6941 | Low | 3.5 | 2024-07-21 | A vulnerability, which was classified as problematic, has been found in ThinkSAAS 3.7.0. This issue affects some unknown processing of the file app/system/acti… |
CVE-2024-40455 | Low | 2.7 | 2024-07-16 | An arbitrary file deletion vulnerability in ThinkSAAS v3.7 allows attackers to delete arbitrary files via a crafted request. |