Browse CVEs

HIGH 7.2 CVE-2022-44036 In b2evolution 7.2.5, if configured with admins_can_manipulate_sensitive_files, arbitrary file upload is allowed for admins, leading to command execu… B2evolution Cms No fix yet Fix from $1,9502023-01-03 CRITICAL 9.1 CVE-2022-30935 An authorization bypass in b2evolution allows remote, unauthenticated attackers to predict password reset tokens for any user through the use of a ba… B2evolution 7.2.5+ Fix from $2,3002022-09-28 CRITICAL 9.8 CVE-2021-31632 b2evolution CMS v7.2.3 was discovered to contain a SQL injection vulnerability via the parameter cfqueryparam in the User login section. This vulnera… B2evolution Cms No fix yet Fix from $2,3002021-12-06 HIGH 8.8 CVE-2021-31631 b2evolution CMS v7.2.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the User login page. This vulnerability allows attackers to … B2evolution Cms No fix yet Fix from $1,9502021-12-06 HIGH 8.8 CVE-2021-28242 SQL Injection in the "evoadm.php" component of b2evolution v7.2.2-stable allows remote attackers to obtain sensitive database information by injectin… B2evolution Patch available Fix from $1,9502021-04-15 MEDIUM 6.1 CVE-2020-22839 Reflected cross-site scripting vulnerability (XSS) in the evoadm.php file in b2evolution cms version 6.11.6-stable allows remote attackers to inject … B2evolution Cms No fix yet Fix from $1,6002021-02-09 MEDIUM 6.1 CVE-2020-22840EPSS 14% Open redirect vulnerability in b2evolution CMS version prior to 6.11.6 allows an attacker to perform malicious open redirects to an attacker controll… B2evolution 6.11.6+ Fix from $1,6002021-02-09 CRITICAL 9.8 CVE-2016-8901 b2evolution 6.7.6 suffer from an Object Injection vulnerability in /htsrv/call_plugin.php. B2evolution Patch available Fix from $2,3002019-05-23 CRITICAL 9.8 CVE-2017-1000423 b2evolution version 6.6.0 - 6.8.10 is vulnerable to input validation (backslash and single quote escape) in basic install functionality resulting in … B2evolution after 6.8.10 Fix from $2,3002018-01-02 CRITICAL 9.1 CVE-2017-5539 The patch for directory traversal (CVE-2017-5480) in b2evolution version 6.8.4-stable has a bypass vulnerability. An attacker can use ..\/ to bypass … B2evolution Patch available Fix from $2,3002017-01-23 MEDIUM 5.4 CVE-2017-5553 Cross-site scripting (XSS) vulnerability in plugins/markdown_plugin/_markdown.plugin.php in b2evolution before 6.8.5 allows remote authenticated user… B2evolution after 6.8.4 Fix from $1,6002017-01-23 MEDIUM 6.1 CVE-2016-7149 Cross-site scripting (XSS) vulnerability in b2evolution 6.7.5 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors … B2evolution after 6.7.5 Fix from $1,6002017-01-18 MEDIUM 5.4 CVE-2016-7150 Cross-site scripting (XSS) vulnerability in b2evolution 6.7.5 and earlier allows remote authenticated users to inject arbitrary web script or HTML vi… B2evolution after 6.7.5 Fix from $1,6002017-01-18 HIGH 8.1 CVE-2017-5480 Directory traversal vulnerability in inc/files/files.ctrl.php in b2evolution through 6.8.3 allows remote authenticated users to read or delete arbitr… B2evolution after 6.8.3 Fix from $1,9502017-01-15 MEDIUM 5.4 CVE-2017-5494 Multiple cross-site scripting (XSS) vulnerabilities in the file types table in b2evolution through 6.8.3 allow remote authenticated users to inject a… B2evolution after 6.8.3 Fix from $1,6002017-01-15 HIGH 7.5 CVE-2016-9479 The "lost password" functionality in b2evolution before 6.7.9 allows remote attackers to reset arbitrary user passwords via a crafted request. B2evolution after 6.7.8 Fix from $1,9502016-12-02 MEDIUM 6.8 CVE-2013-7352 Cross-site request forgery (CSRF) vulnerability in blogs/admin.php in b2evolution before 4.1.7 allows remote attackers to hijack the authentication o… B2evolution after 4.1.6 Fix from $1,6002014-04-02 MEDIUM 6.5 CVE-2013-2945 SQL injection vulnerability in blogs/admin.php in b2evolution before 4.1.7 allows remote authenticated administrators to execute arbitrary SQL comman… B2evolution after 4.1.6 Fix from $1,6002014-04-02 MEDIUM 6.5 CVE-2012-5910 SQL injection vulnerability in blogs/htsrv/viewfile.php in b2evolution 4.1.3 allows remote authenticated users to execute arbitrary SQL commands via … B2evolution Mitigation only Fix from $1,6002012-11-17 MEDIUM 5.0 CVE-2011-3709 b2evolution 3.3.3 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in… B2evolution No fix yet Fix from $1,6002011-09-23 HIGH 7.5 CVE-2009-1657 Multiple SQL injection vulnerabilities in the Starrating plugin before 0.7.7 for b2evolution allow remote attackers to execute arbitrary SQL commands… Starrating Plugin after 0.7.6 Fix from $1,9502009-05-18 HIGH 7.5 CVE-2007-2681 Directory traversal vulnerability in blogs/index.php in b2evolution 1.6 allows remote attackers to include and execute arbitrary local files via a ..… B2evolution Mitigation only Fix from $1,9502007-05-15 HIGH 7.5 CVE-2007-2358 Multiple PHP remote file inclusion vulnerabilities in b2evolution allow remote attackers to execute arbitrary PHP code via a URL in the (1) inc_path … B2evolution Mitigation only Fix from $1,9502007-04-30 HIGH 7.5 CVE-2006-6417 PHP remote file inclusion vulnerability in inc/CONTROL/import/import-mt.php in b2evolution 1.8.5 through 1.9 beta allows remote attackers to execute … B2evolution No fix yet Fix from $1,9502006-12-10 MEDIUM 6.8 CVE-2006-6197 Multiple cross-site scripting (XSS) vulnerabilities in b2evolution 1.8.2 through 1.9 beta allow remote attackers to inject arbitrary web script or HT… B2evolution No fix yet Fix from $1,6002006-12-01