Bigtreecms: >> Bigtree Cms >> 4.2.19 Security Vulnerabilities
A SQL injection vulnerability was discovered in /core/feeds/custom.php in BigTree CMS 4.4.10 and earlier which allows an authenticated attacker to inject a malicious SQL query to the applications via the 'Create New Feed' function.
CVSS Score
8.8
EPSS Score
0.003
Published
2021-06-01
A stored cross-site scripting (XSS) vulnerability was discovered in BigTree CMS 4.4.10 and earlier which allows an authenticated attacker to execute arbitrary web scripts or HTML via the page content to site/index.php/admin/pages/update.
CVSS Score
5.4
EPSS Score
0.002
Published
2021-06-01
A vulnerability has been discovered in BigTree CMS 4.4.10 and earlier which allows an authenticated attacker to execute arbitrary commands through a crafted request sent to the server via the 'Create a New Setting' function.
CVSS Score
8.8
EPSS Score
0.011
Published
2021-06-01
A Session Fixation issue was discovered in Bigtree before 4.2.24. admin.php accepts a user-provided PHP session ID instead of regenerating a new one after a user has logged in to the application. The Session Fixation could allow an attacker to hijack an admin session.
CVSS Score
5.4
EPSS Score
0.003
Published
2018-10-19
BigTree before 4.2.22 has XSS in the Users management page via the name or company field.
CVSS Score
5.4
EPSS Score
0.002
Published
2018-04-30
site/index.php/admin/trees/add/ in BigTree 4.2.22 and earlier allows remote attackers to upload and execute arbitrary PHP code because the BigTreeStorage class in core/inc/bigtree/apis/storage.php does not prevent uploads of .htaccess files.
CVSS Score
9.8
EPSS Score
0.009
Published
2018-04-30
Cross-site scripting (XSS) in BigTree 4.2.19 allows any remote users to inject arbitrary web script or HTML via the directory parameter. This issue exists in core/admin/ajax/developer/extensions/file-browser.php.
CVSS Score
5.4
EPSS Score
0.002
Published
2018-01-23
A SQL injection vulnerability in core/inc/auto-modules.php in BigTree CMS through 4.2.19 allows remote authenticated attackers to obtain information in the context of the user used by the application to retrieve data from the database. The attack uses an admin/trees/add/process request with a crafted _tags[] parameter that is mishandled in a later admin/ajax/dashboard/approve-change request.
CVSS Score
6.5
EPSS Score
0.002
Published
2017-11-27