Threats affecting pkg:github/299ko/CMS

236 threats

Severity	CVSS	Signals	Threat	Source	Published
Medium	5.5	EPSS 0.2%	CVE-2024-28429cms · Cross-Site Request Forgery (CSRF) Medium5.5EPSS 0.2%2024-03-13CVE Database V5CVE-2024-28429 DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/archives_do.php EPSS 0.2%Vulnerability CWE-352	CVE Database V5	2024-03-13
High	7.4	EPSS 0.2%	CVE-2024-27694cms · Cross-Site Request Forgery (CSRF) High7.4EPSS 0.2%2024-03-04CVE Database V5CVE-2024-27694 FlyCms v1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the /system/share/ztree_category_edit. EPSS 0.2%Vulnerability CWE-352	CVE Database V5	2024-03-04
Medium	6.1	EPSS 0.4%	CVE-2024-27680cms · Cross-site Scripting Medium6.1EPSS 0.4%2024-03-04CVE Database V5CVE-2024-27680 Flusity-CMS v2.33 is vulnerable to Cross Site Scripting (XSS) in the "Contact form." EPSS 0.4%Vulnerability CWE-79	CVE Database V5	2024-03-04
Medium	6.1	EPSS 0.5%	CVE-2024-27734cms · A Cross Site Scripting Medium6.1EPSS 0.5%2024-03-01CVE Database V5CVE-2024-27734 A Cross Site Scripting vulnerability in CSZ CMS v.1.3.0 allows an attacker to execute arbitrary code via a crafted script to the Site Name fields of the Site Settings component. EPSS 0.5%Vulnerability CWE-79	CVE Database V5	2024-03-01
High	8.8	EPSS 0.3%	CVE-2024-27689cms · Cross-Site Request Forgery (CSRF) High8.8EPSS 0.3%2024-03-01CVE Database V5CVE-2024-27689 Stupid Simple CMS v1.2.4 was discovered to contain a Cross-Site Request Forgery (CSRF) via /update-article.php. EPSS 0.3%Vulnerability CWE-352	CVE Database V5	2024-03-01
Medium	6.3	EPSS 0.2%	CVE-2024-27559cms · Cross-Site Request Forgery (CSRF) Medium6.3EPSS 0.2%2024-03-01CVE Database V5CVE-2024-27559 Stupid Simple CMS v1.2.4 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /save_settings.php EPSS 0.2%Vulnerability CWE-352	CVE Database V5	2024-03-01
Medium	6.1	EPSS 0.4%	CVE-2024-26491cms · A Cross-site Scripting (XSS) Medium6.1EPSS 0.4%2024-02-22CVE Database V5CVE-2024-26491 A cross-site scripting (XSS) vulnerability in the Addon JD Flusity 'Media Gallery with description' module of flusity-CMS v2.33 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Gallery name text field. EPSS 0.4%Vulnerability CWE-79	CVE Database V5	2024-02-22
Medium	5.4	EPSS 0.4%	CVE-2024-26490cms · A Cross-site Scripting (XSS) Medium5.4EPSS 0.4%2024-02-22CVE Database V5CVE-2024-26490 A cross-site scripting (XSS) vulnerability in the Addon JD Simple module of flusity-CMS v2.33 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title text field. EPSS 0.4%Vulnerability CWE-79	CVE Database V5	2024-02-22
Medium	6.1	EPSS 0.2%	CVE-2024-26445cms · Cross-Site Request Forgery (CSRF) Medium6.1EPSS 0.2%2024-02-22CVE Database V5CVE-2024-26445 flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /core/tools/delete_place.php EPSS 0.2%Vulnerability CWE-352	CVE Database V5	2024-02-22
Medium	6.1	EPSS 0.2%	CVE-2024-26351cms · Cross-Site Request Forgery (CSRF) Medium6.1EPSS 0.2%2024-02-22CVE Database V5CVE-2024-26351 flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /core/tools/update_place.php EPSS 0.2%Vulnerability CWE-352	CVE Database V5	2024-02-22
High	8.8	EPSS 0.5%	CVE-2024-24469cms · Cross-Site Request Forgery High8.8EPSS 0.5%2024-02-05CVE Database V5CVE-2024-24469 Cross Site Request Forgery vulnerability in flusity-CMS v.2.33 allows a remote attacker to execute arbitrary code via the delete_post .php. EPSS 0.5%Vulnerability CWE-94	CVE Database V5	2024-02-05
High	8.8	EPSS 0.5%	CVE-2024-24524cms · Cross Site Request Forgery (CSRF) High8.8EPSS 0.5%2024-02-02CVE Database V5CVE-2024-24524 Cross Site Request Forgery (CSRF) vulnerability in flusity-CMS v.2.33, allows remote attackers to execute arbitrary code via the add_menu.php component. EPSS 0.5%Vulnerability CWE-352	CVE Database V5	2024-02-02
High	8.8	EPSS 0.3%	CVE-2024-22603cms · Cross-Site Request Forgery (CSRF) High8.8EPSS 0.3%2024-01-18CVE Database V5CVE-2024-22603 FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/links/add_link EPSS 0.3%Vulnerability CWE-352	CVE Database V5	2024-01-18
Medium	5.4	EPSS 0.4%	CVE-2024-22548FlyCms · Cross-site Scripting Medium5.4EPSS 0.4%2024-01-18CVE Database V5CVE-2024-22548 FlyCms 1.0 is vulnerable to Cross Site Scripting (XSS) in the system website settings website name section. EPSS 0.4%Vulnerability CWE-79	CVE Database V5	2024-01-18
High	8.8	EPSS 0.3%	CVE-2023-52073FlyCms · Cross-Site Request Forgery (CSRF) High8.8EPSS 0.3%2024-01-08CVE Database V5CVE-2023-52073 FlyCms v1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /system/site/config_footer_updagte. EPSS 0.3%Vulnerability CWE-352	CVE Database V5	2024-01-08
Medium	5.4	EPSS 0.4%	CVE-2023-49485JFinalCMS · Cross-site Scripting Medium5.4EPSS 0.4%2023-12-08CVE Database V5CVE-2023-49485 JFinalCMS v5.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the column management department. EPSS 0.4%Vulnerability CWE-79	CVE Database V5	2023-12-08

Page 12 of 12