Tribalsystems Zenario
21 CVEs affecting Tribalsystems Zenario. Latest disclosed: 2024-10-02. Critical: 2, High: 4.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-44136 | Critical | 9.8 | 2022-11-30 | Zenario CMS 9.3.57186 is vulnerable to Remote Code Excution (RCE). |
CVE-2021-26830 | Critical | 9.1 | 2021-04-16 | SQL Injection in Tribalsystems Zenario CMS 8.8.52729 allows remote attackers to access the database or delete the plugin. This is accomplished via the `ID` inp… |
CVE-2018-18420 | High | 8.8 | 2018-10-19 | Cross-Site Request Forgery (CSRF) vulnerability was discovered in the 8.3 version of Zenario Content Management System via the admin/organizer.ajax.php?path=ze… |
CVE-2018-5960 | High | 8.8 | 2018-01-22 | Zenario v7.1 - v7.6 has SQL injection via the `Name` input field of organizer.php or admin_boxes.ajax.php in the `Categories - Edit` module. |
CVE-2021-42171 | High | 7.2 | 2022-03-14 | Zenario CMS 9.0.54156 is vulnerable to File Upload. The web server can be compromised by uploading and executing a web-shell which can run commands, browse sys… |
CVE-2022-23043 | High | 7.2 | 2022-02-24 | Zenario CMS 9.2 allows an authenticated admin user to bypass the file upload restriction by creating a new 'File/MIME Types' using the '.phar' extension. Then… |
CVE-2023-44769 | Medium | 5.4 | 2023-10-25 | A Cross-Site Scripting (XSS) vulnerability in Zenario CMS v.9.4.59197 allows a local attacker to execute arbitrary code via a crafted script to the Spare alias… |
CVE-2023-44771 | Medium | 5.4 | 2023-10-06 | A Cross-Site Scripting (XSS) vulnerability in Zenario CMS v.9.4.59197 allows a local attacker to execute arbitrary code via a crafted script to the Page Layout. |
CVE-2023-44770 | Medium | 5.4 | 2023-10-06 | A Cross-Site Scripting (XSS) vulnerability in Zenario CMS v.9.4.59197 allows an attacker to execute arbitrary code via a crafted script to the Organizer - Spar… |
CVE-2022-44073 | Medium | 5.4 | 2022-11-16 | Zenario CMS 9.3.57186 is vulnerable to Cross Site Scripting (XSS) via svg,Users & Contacts. |
CVE-2022-44071 | Medium | 5.4 | 2022-11-16 | Zenario CMS 9.3.57186 is is vulnerable to Cross Site Scripting (XSS) via profile. |
CVE-2022-44070 | Medium | 5.4 | 2022-11-16 | Zenario CMS 9.3.57186 is vulnerable to Cross Site Scripting (XSS) via News articles. |
CVE-2022-44069 | Medium | 5.4 | 2022-11-16 | Zenario CMS 9.3.57186 is vulnerable to Cross Site Scripting (XSS) via the Nest library module. |
CVE-2021-27672 | Medium | 4.9 | 2021-04-15 | SQL Injection in the "admin_boxes.ajax.php" component of Tribal Systems Zenario CMS v8.8.52729 allows remote attackers to obtain sesnitive database information… |
CVE-2024-45964 | Medium | 4.8 | 2024-10-02 | Zenario 9.7.61188 is vulnerable to Cross Site Scripting (XSS) in the Image library via the "Organizer tags" field. |
CVE-2024-45960 | Medium | 4.8 | 2024-10-02 | Zenario 9.7.61188 allows authenticated admin users to upload PDF files containing malicious code into the target system. If the PDF file is accessed through th… |
CVE-2023-39578 | Medium | 4.8 | 2023-08-28 | A stored cross-site scripting (XSS) vulnerability in the Create function of Zenario CMS v9.4 allows attackers to execute arbitrary web scripts or HTML via a cr… |
CVE-2021-41952 | Medium | 4.8 | 2022-03-14 | Zenario CMS 9.0.54156 is vulnerable to Cross Site Scripting (XSS) via upload file to *.SVG. An attacker can send malicious files to victims and steals victim's… |
CVE-2021-27673 | Medium | 4.8 | 2021-04-15 | Cross Site Scripting (XSS) in the "admin_boxes.ajax.php" component of Tribal Systems Zenario CMS v8.8.52729 allows remote attackers to execute arbitrary code b… |
CVE-2022-4231 | Medium | 4.2 | 2022-11-30 | A vulnerability, which was classified as problematic, has been found in Tribal Systems Zenario CMS 9.3.57595. This issue affects some unknown processing of the… |