Travianz Project: >> Travianz >> 8.3.4 Security Vulnerabilities
PHP injection in TravianZ 8.3.4 and 8.3.3 in the config editor in the admin page allows remote attackers to execute PHP code.
CVSS Score
7.2
EPSS Score
0.003
Published
2023-07-07
The cryptographically insecure random number generator being used in TravianZ 8.3.4 and 8.3.3 in the password reset function allows an attacker to guess the password reset.parameters and to take over accounts.
CVSS Score
9.8
EPSS Score
0.001
Published
2023-07-07
In TravianZ 8.3.4 and 8.3.3, Incorrect Access Control in the installation script allows an attacker to overwrite the server configuration and inject PHP code.
CVSS Score
9.8
EPSS Score
0.001
Published
2023-07-07
TravianZ through 8.3.4 allows XSS via the Alliance tag/name, the statistics page, the link preferences, the Admin Logs, or the COOKUSR cookie.
CVSS Score
6.1
EPSS Score
0.001
Published
2023-07-06