Threats affecting pkg:github/lavalite/cms

236 threats

Severity	CVSS	Signals	Threat	Source	Published
Medium	6.5	EPSS 0.6%	CVE-2024-39036CMS · Path Traversal Medium6.5EPSS 0.6%2024-07-16CVE Database V5CVE-2024-39036 SeaCMS v12.9 is vulnerable to Arbitrary File Read via admin_safe.php. EPSS 0.6%Vulnerability CWE-22	CVE Database V5	2024-07-16
Medium	6.1	EPSS 0.4%	CVE-2024-40336cms · Cross-site Scripting Medium6.1EPSS 0.4%2024-07-10CVE Database V5CVE-2024-40336 idccms v1.35 is vulnerable to Cross Site Scripting (XSS) within the 'Image Advertising Management.' EPSS 0.4%Vulnerability CWE-79	CVE Database V5	2024-07-10
High	8.8	EPSS 0.3%	CVE-2024-40334cms · Cross-Site Request Forgery (CSRF) High8.8EPSS 0.3%2024-07-10CVE Database V5CVE-2024-40334 idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/serverFile_deal.php?mudi=upFileDel&dataID=3 EPSS 0.3%Vulnerability CWE-352	CVE Database V5	2024-07-10
High	8.8	EPSS 0.6%	CVE-2024-40333cms · Cross-site Scripting High8.8EPSS 0.6%2024-07-10CVE Database V5CVE-2024-40333 idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/softBak_deal.php?mudi=del&dataID=2 EPSS 0.6%Vulnerability CWE-79	CVE Database V5	2024-07-10
Medium	6.8	EPSS 0.2%	CVE-2024-40332cms · Cross-Site Request Forgery (CSRF) Medium6.8EPSS 0.2%2024-07-10CVE Database V5CVE-2024-40332 idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/moneyRecord_deal.php?mudi=delRecord EPSS 0.2%Vulnerability CWE-352	CVE Database V5	2024-07-10
High	8.8	EPSS 0.3%	CVE-2024-40331cms · Cross-Site Request Forgery (CSRF) High8.8EPSS 0.3%2024-07-10CVE Database V5CVE-2024-40331 idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/dbBakMySQL_deal.php?mudi=backup EPSS 0.3%Vulnerability CWE-352	CVE Database V5	2024-07-10
High	8.8	EPSS 0.3%	CVE-2024-40329cms · Cross-Site Request Forgery (CSRF) High8.8EPSS 0.3%2024-07-10CVE Database V5CVE-2024-40329 idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/softBak_deal.php?mudi=backup EPSS 0.3%Vulnerability CWE-352	CVE Database V5	2024-07-10
Medium	6.3	EPSS 0.2%	CVE-2024-40328cms · Cross-Site Request Forgery (CSRF) Medium6.3EPSS 0.2%2024-07-10CVE Database V5CVE-2024-40328 idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/memberOnline_deal.php?mudi=del&dataType=&dataID=6 EPSS 0.2%Vulnerability CWE-352	CVE Database V5	2024-07-10
Medium	5.3	EPSS 0.2%	CVE-2024-40038cms · Cross-Site Request Forgery (CSRF) Medium5.3EPSS 0.2%2024-07-09CVE Database V5CVE-2024-40038 idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/userScore_deal.php?mudi=rev EPSS 0.2%Vulnerability CWE-352	CVE Database V5	2024-07-09
High	8.8	EPSS 0.3%	CVE-2024-40037cms · Cross-Site Request Forgery (CSRF) High8.8EPSS 0.3%2024-07-09CVE Database V5CVE-2024-40037 idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/userScore_deal.php?mudi=del EPSS 0.3%Vulnerability CWE-352	CVE Database V5	2024-07-09
High	8.8	EPSS 0.6%	CVE-2024-40036cms · Cross-site Scripting High8.8EPSS 0.6%2024-07-09CVE Database V5CVE-2024-40036 idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/userGroup_deal.php?mudi=add&nohrefStr=close EPSS 0.6%Vulnerability CWE-79	CVE Database V5	2024-07-09
Medium	5.9	EPSS 0.2%	CVE-2024-40035cms · Cross-Site Request Forgery (CSRF) Medium5.9EPSS 0.2%2024-07-09CVE Database V5CVE-2024-40035 idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/userLevel_deal.php?mudi=add. EPSS 0.2%Vulnerability CWE-352	CVE Database V5	2024-07-09
High	8.8	EPSS 0.3%	CVE-2024-40034cms · Cross-Site Request Forgery (CSRF) High8.8EPSS 0.3%2024-07-09CVE Database V5CVE-2024-40034 idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/userLevel_deal.php?mudi=del EPSS 0.3%Vulnerability CWE-352	CVE Database V5	2024-07-09
High	7.5	EPSS 0.4%	CVE-2024-39027CMS · SQL Injection High7.5EPSS 0.4%2024-07-05CVE Database V5CVE-2024-39027 SeaCMS v12.9 has an unauthorized SQL injection vulnerability. The vulnerability is caused by the SQL injection through the cid parameter at /js/player/dmplayer/dmku/index.php?ac=edit, which can cause sensitive database information to be leaked. EPSS 0.4%Vulnerability CWE-89	CVE Database V5	2024-07-05
Medium	5.4	EPSS 0.2%	CVE-2024-39119cms · Cross-Site Request Forgery (CSRF) Medium5.4EPSS 0.2%2024-07-02CVE Database V5CVE-2024-39119 idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via admin/info_deal.php?mudi=rev&nohrefStr=close. EPSS 0.2%Vulnerability CWE-352	CVE Database V5	2024-07-02
Medium	4.3	EPSS 0.6%	CVE-2024-33442cms · Code Injection Medium4.3EPSS 0.6%2024-05-01CVE Database V5CVE-2024-33442 An issue in flusity-CMS v.2.33 allows a remote attacker to execute arbitrary code via the add_post.php component. EPSS 0.6%Vulnerability CWE-94	CVE Database V5	2024-05-01
Critical	9.8	EPSS 1.1%	CVE-2024-32418cms · Improper Privilege Management Critical9.8EPSS 1.1%2024-04-22CVE Database V5CVE-2024-32418 An issue in flusity CMS v2.33 allows a remote attacker to execute arbitrary code via the add_addon.php component. EPSS 1.1%Vulnerability CWE-269	CVE Database V5	2024-04-22
Medium	5.4	EPSS 0.6%	CVE-2024-27752cms · Cross-site Scripting Medium5.4EPSS 0.6%2024-04-19CVE Database V5CVE-2024-27752 Cross Site Scripting vulnerability in CSZ CMS v.1.3.0 allows a remote attacker to execute arbitrary code via the Default Keyword field in the settings function. EPSS 0.6%Vulnerability CWE-79	CVE Database V5	2024-04-19
High	8.8	EPSS 0.4%	CVE-2024-30965cms · Cross-Site Request Forgery (CSRF) High8.8EPSS 0.4%2024-04-02CVE Database V5CVE-2024-30965 DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /src/dede/member_scores.php. EPSS 0.4%Vulnerability CWE-352	CVE Database V5	2024-04-02
Medium	5.5	EPSS 0.2%	CVE-2024-30946cms · Cross-Site Request Forgery (CSRF) Medium5.5EPSS 0.2%2024-04-02CVE Database V5CVE-2024-30946 DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /src/dede/co_do.php. EPSS 0.2%Vulnerability CWE-352	CVE Database V5	2024-04-02

Page 10 of 12