Bagecms

bagecms

Vendor: Bagesoft • 7 CVEs

CVEs (7)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2023-37122 1Bagesoft 1Bagecms Nov 21, 2024 Jul 6, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 A stored cross-site scripting (XSS) vulnerability in Bagecms v3.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Custom Settings module.
CVE-2019-8421 1Bagesoft 1Bagecms Nov 21, 2024 Feb 17, 2019 N/A· v4 7.2 HIGH· v3 6.5 MEDIUM· v2 upload/protected/modules/admini/views/post/index.php in BageCMS through 3.1.4 allows SQL Injection via the title or titleAlias parameter.
CVE-2018-19560 1Bagesoft 1Bagecms Nov 21, 2024 Nov 26, 2018 N/A· v4 8.8 HIGH· v3 9.3 HIGH· v2 BageCMS 3.1.3 has CSRF via upload/index.php?r=admini/admin/ownerUpdate to modify a user account.
CVE-2018-19104 1Bagesoft 1Bagecms Nov 21, 2024 Nov 8, 2018 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 In BageCMS 3.1.3, upload/index.php has a CSRF vulnerability that can be used to upload arbitrary files and get server privileges.
CVE-2018-18258 1Bagesoft 1Bagecms Nov 21, 2024 Oct 11, 2018 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 An issue was discovered in BageCMS 3.1.3. The attacker can execute arbitrary PHP code on the web server and can read any file on the web server via an index.php?r=admini/template/updateTpl&filename= URI.
CVE-2018-18257 1Bagesoft 1Bagecms Nov 21, 2024 Oct 11, 2018 N/A· v4 7.5 HIGH· v3 6.4 MEDIUM· v2 An issue was discovered in BageCMS 3.1.3. An attacker can delete any files and folders on the web server via an index.php?r=admini/template/batch&command=deleteFile&fileName= or index.php?r=admini/template/batch&command=...Show more An issue was discovered in BageCMS 3.1.3. An attacker can delete any files and folders on the web server via an index.php?r=admini/template/batch&command=deleteFile&fileName= or index.php?r=admini/template/batch&command=deleteFolder&folderName=../ directory traversal URI.Show less
CVE-2018-14582 1Bagesoft 1Bagecms Nov 21, 2024 Jul 24, 2018 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 index.php?r=admini/admin/create in BageCMS V3.1.3 allows CSRF to add a background administrator account.