Bigtreecms

bigtreecms

45 CVEs • 2 products

Products (2)

Click to collapse

Toggle

CVEs (45)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2017-9546 1Bigtreecms 1Bigtree Cms May 13, 2026 Jun 12, 2017 N/A· v4 5.7 MEDIUM· v3 3.5 LOW· v2 admin.php in BigTree through 4.2.18 allows remote authenticated users to cause a denial of service (inability to save revisions) via XSS sequences in a revision name.
CVE-2017-9449 1Bigtreecms 1Bigtree Cms May 13, 2026 Jun 6, 2017 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 SQL injection vulnerability in BigTree CMS through 4.2.18 allows remote authenticated users to execute arbitrary SQL commands via core/admin/modules/developer/modules/views/create.php. The attacker creates a crafted tabl...Show more SQL injection vulnerability in BigTree CMS through 4.2.18 allows remote authenticated users to execute arbitrary SQL commands via core/admin/modules/developer/modules/views/create.php. The attacker creates a crafted table name at admin/developer/modules/views/create/ and the injection is visible at admin/ajax/auto-modules/views/searchable-page/ or admin/modules_name.Show less
CVE-2017-9448 1Bigtreecms 1Bigtree Cms May 13, 2026 Jun 6, 2017 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Cross-site scripting (XSS) vulnerabilities in BigTree CMS through 4.2.18 allow remote authenticated users to inject arbitrary web script or HTML via the description parameter. This issue exists in core\admin\ajax\pages\s...Show more Cross-site scripting (XSS) vulnerabilities in BigTree CMS through 4.2.18 allow remote authenticated users to inject arbitrary web script or HTML via the description parameter. This issue exists in core\admin\ajax\pages\save-revision.php and core\admin\modules\pages\revisions.php. Low-privileged (administrator) users can attack high-privileged (Developer) users.Show less
CVE-2017-9444 1Bigtreecms 1Bigtree Cms May 13, 2026 Jun 5, 2017 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 BigTree CMS through 4.2.18 has CSRF related to the core\admin\modules\users\profile\update.php script (modify user information), the index.php/admin/developer/packages/delete/ URI (remove packages), the index.php/admin/d...Show more BigTree CMS through 4.2.18 has CSRF related to the core\admin\modules\users\profile\update.php script (modify user information), the index.php/admin/developer/packages/delete/ URI (remove packages), the index.php/admin/developer/upgrade/ignore/?versions= URI, and the index.php/admin/developer/upgrade/set-ftp-directory/ URI.Show less
CVE-2017-9443 1Bigtreecms 1Bigtree Cms May 13, 2026 Jun 5, 2017 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 BigTree CMS through 4.2.18 allows remote authenticated users to conduct SQL injection attacks via a crafted tables object in manifest.json in an uploaded package. This issue exists in core\admin\modules\developer\extensi...Show more BigTree CMS through 4.2.18 allows remote authenticated users to conduct SQL injection attacks via a crafted tables object in manifest.json in an uploaded package. This issue exists in core\admin\modules\developer\extensions\install\process.php and core\admin\modules\developer\packages\install\process.php. NOTE: the vendor states "You must implicitly trust any package or extension you install as they all have the ability to write PHP files.Show less
CVE-2017-9442 1Bigtreecms 1Bigtree Cms May 13, 2026 Jun 5, 2017 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 BigTree CMS through 4.2.18 allows remote authenticated users to execute arbitrary code by uploading a crafted package containing a PHP web shell, related to extraction of a ZIP archive to filename patterns such as cache/...Show more BigTree CMS through 4.2.18 allows remote authenticated users to execute arbitrary code by uploading a crafted package containing a PHP web shell, related to extraction of a ZIP archive to filename patterns such as cache/package/xxx/yyy.php. This issue exists in core\admin\modules\developer\extensions\install\unpack.php and core\admin\modules\developer\packages\install\unpack.php. NOTE: the vendor states "You must implicitly trust any package or extension you install as they all have the ability to write PHP files.Show less
CVE-2017-9441 1Bigtreecms 1Bigtree Cms May 13, 2026 Jun 5, 2017 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Multiple cross-site scripting (XSS) vulnerabilities in BigTree CMS through 4.2.18 allow remote authenticated users to inject arbitrary web script or HTML by uploading a crafted package, triggering mishandling of the (1)...Show more Multiple cross-site scripting (XSS) vulnerabilities in BigTree CMS through 4.2.18 allow remote authenticated users to inject arbitrary web script or HTML by uploading a crafted package, triggering mishandling of the (1) title or (2) version or (3) author_name parameter in manifest.json. This issue exists in core\admin\modules\developer\extensions\install\unpack.php and core\admin\modules\developer\packages\install\unpack.php. NOTE: the vendor states "You must implicitly trust any package or extension you install as they all have the ability to write PHP files.Show less
CVE-2017-9428 1Bigtreecms 1Bigtree Cms May 13, 2026 Jun 4, 2017 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 A directory traversal vulnerability exists in core\admin\ajax\developer\extensions\file-browser.php in BigTree CMS through 4.2.18 on Windows, allowing attackers to read arbitrary files via ..\ sequences in the directory...Show more A directory traversal vulnerability exists in core\admin\ajax\developer\extensions\file-browser.php in BigTree CMS through 4.2.18 on Windows, allowing attackers to read arbitrary files via ..\ sequences in the directory parameter.Show less
CVE-2017-9427 1Bigtreecms 1Bigtree Cms May 13, 2026 Jun 4, 2017 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 SQL injection vulnerability in BigTree CMS through 4.2.18 allows remote authenticated users to execute arbitrary SQL commands via core\admin\modules\developer\modules\designer\form-create.php. The attacker creates a craf...Show more SQL injection vulnerability in BigTree CMS through 4.2.18 allows remote authenticated users to execute arbitrary SQL commands via core\admin\modules\developer\modules\designer\form-create.php. The attacker creates a crafted table name at admin/developer/modules/designer/ and the injection is visible at admin/dashboard/vitals-statistics/integrity/check/?external=true.Show less
CVE-2017-9379 1Bigtreecms 1Bigtree Cms May 13, 2026 Jun 2, 2017 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 Multiple CSRF issues exist in BigTree CMS through 4.2.18 - the clear parameter to core\admin\modules\dashboard\vitals-statistics\404\clear.php and the from or to parameter to core\admin\modules\dashboard\vitals-statistic...Show more Multiple CSRF issues exist in BigTree CMS through 4.2.18 - the clear parameter to core\admin\modules\dashboard\vitals-statistics\404\clear.php and the from or to parameter to core\admin\modules\dashboard\vitals-statistics\404\create-301.php.Show less
CVE-2017-9378 1Bigtreecms 1Bigtree Cms May 13, 2026 Jun 2, 2017 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 BigTree CMS through 4.2.18 does not prevent a user from deleting their own account. This could have security relevance because deletion was supposed to be an admin-only action, and the admin may have other tasks (such as...Show more BigTree CMS through 4.2.18 does not prevent a user from deleting their own account. This could have security relevance because deletion was supposed to be an admin-only action, and the admin may have other tasks (such as data backups) to complete before a user is deleted.Show less
CVE-2017-9365 1Bigtreecms 1Bigtree Cms May 13, 2026 Jun 2, 2017 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 CSRF exists in BigTree CMS through 4.2.18 with the force parameter to /admin/pages/revisions.php - for example: /admin/pages/revisions/1/?force=false. A page with id=1 can be unlocked.
CVE-2017-9364 1Bigtreecms 1Bigtree Cms May 13, 2026 Jun 2, 2017 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Unrestricted File Upload exists in BigTree CMS through 4.2.18: if an attacker uploads an 'xxx.pht' or 'xxx.phtml' file, they could bypass a safety check and execute any code.
CVE-2017-7881 1Bigtreecms 1Bigtree Cms May 13, 2026 Apr 15, 2017 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 BigTree CMS through 4.2.17 relies on a substring check for CSRF protection, which allows remote attackers to bypass this check by placing the required admin/developer/ URI within a query string in an HTTP Referer header....Show more BigTree CMS through 4.2.17 relies on a substring check for CSRF protection, which allows remote attackers to bypass this check by placing the required admin/developer/ URI within a query string in an HTTP Referer header. This was found in core/admin/modules/developer/_header.php and patched in core/inc/bigtree/admin.php on 2017-04-14.Show less
CVE-2017-7695 1Bigtreecms 1Bigtree Cms May 13, 2026 Apr 11, 2017 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Unrestricted File Upload exists in BigTree CMS before 4.2.17: if an attacker uploads an 'xxx.php[space]' file, they could bypass a safety check and execute any code.
CVE-2017-6918 1Bigtreecms 1Bigtree Cms May 13, 2026 Mar 15, 2017 N/A· v4 4.3 MEDIUM· v3 4.3 MEDIUM· v2 CSRF exists in BigTree CMS 4.2.16 with the value[#][*] parameter to the admin/settings/update/ page. The Navigation Social can be changed.
CVE-2017-6917 1Bigtreecms 1Bigtree Cms May 13, 2026 Mar 15, 2017 N/A· v4 4.3 MEDIUM· v3 4.3 MEDIUM· v2 CSRF exists in BigTree CMS 4.2.16 with the value parameter to the admin/settings/update/ page. The Colophon can be changed.
CVE-2017-6916 1Bigtreecms 1Bigtree Cms May 13, 2026 Mar 15, 2017 N/A· v4 4.3 MEDIUM· v3 4.3 MEDIUM· v2 CSRF exists in BigTree CMS 4.1.18 with the nav-social[#] parameter to the admin/settings/update/ page. The Navigation Social can be changed.
CVE-2017-6915 1Bigtreecms 1Bigtree Cms May 13, 2026 Mar 15, 2017 N/A· v4 4.3 MEDIUM· v3 4.3 MEDIUM· v2 CSRF exists in BigTree CMS 4.1.18 with the colophon parameter to the admin/settings/update/ page. The Colophon can be changed.
CVE-2017-6914 1Bigtreecms 1Bigtree Cms May 13, 2026 Mar 15, 2017 N/A· v4 7.1 HIGH· v3 5.8 MEDIUM· v2 CSRF exists in BigTree CMS 4.1.18 and 4.2.16 with the id parameter to the admin/ajax/users/delete/ page. A user can be deleted.

Previous 123 Next