Bigtreecms : Security Vulnerabilities, CVEs, Published In 2013
Cross-site request forgery (CSRF) vulnerability in core/admin/modules/users/update.php in BigTree CMS 4.0 RC2 and earlier allows remote attackers to hijack the authentication of administrators for requests that modify arbitrary user accounts via an edit user action.
Max CVSS
6.8
EPSS Score
0.14%
Published
2013-08-19
Updated
2013-08-20
Cross-site request forgery (CSRF) vulnerability in core/admin/modules/users/create.php in BigTree CMS 4.0 RC2 and earlier allows remote attackers to hijack the authentication of administrators for requests that create an administrative user via an add user action to index.php.
Max CVSS
6.8
EPSS Score
0.21%
Published
2013-08-19
Updated
2017-08-29
Cross-site scripting (XSS) vulnerability in core/admin/modules/developer/modules/views/add.php in BigTree CMS 4.0 RC2 and earlier allows remote attackers to inject arbitrary web script or HTML via the module parameter.
Max CVSS
4.3
EPSS Score
0.26%
Published
2013-08-14
Updated
2017-08-29
SQL injection vulnerability in core/inc/bigtree/cms.php in BigTree CMS 4.0 RC2 and earlier allows remote attackers to execute arbitrary SQL commands via the PATH_INFO to index.php.
Max CVSS
7.5
EPSS Score
0.43%
Published
2013-08-14
Updated
2017-08-29
4 vulnerabilities found