Threats affecting pkg:github/icycu123/flusity-CMS

4 threats

Severity	CVSS	Signals	Threat	Source	Published
Medium	6.1	EPSS 0.4%	CVE-2024-27757flusity-CMS · Cross-site Scripting Medium6.1EPSS 0.4%2024-03-18CVE Database V5CVE-2024-27757 flusity CMS through 2.45 allows tools/addons_model.php Gallery Name XSS. The reporter indicates that this product "ceased its development as of February 2024." EPSS 0.4%Vulnerability CWE-79	CVE Database V5	2024-03-18
Medium	6.5	EPSS 0.6%	CVE-2024-25410flusity-CMS · Unrestricted File Upload Medium6.5EPSS 0.6%2024-02-26CVE Database V5CVE-2024-25410 flusity-CMS 2.33 is vulnerable to Unrestricted Upload of File with Dangerous Type in update_setting.php. EPSS 0.6%Vulnerability CWE-434	CVE Database V5	2024-02-26
High	8.8	EPSS 0.3%	CVE-2024-26352flusity-CMS · Cross-Site Request Forgery (CSRF) High8.8EPSS 0.3%2024-02-22CVE Database V5CVE-2024-26352 flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /core/tools/add_places.php EPSS 0.3%Vulnerability CWE-352	CVE Database V5	2024-02-22
Critical	9.8	EPSS 1.4%	CVE-2024-25502flusity-CMS · Directory Traversal Critical9.8EPSS 1.4%2024-02-15CVE Database V5CVE-2024-25502 Directory Traversal vulnerability in flusity CMS v.2.4 allows a remote attacker to execute arbitrary code and obtain sensitive information via the download_backup.php component. EPSS 1.4%Vulnerability CWE-94	CVE Database V5	2024-02-15

Page 1 of 1