Websitebaker : Security Vulnerabilities, CVEs,
WebsiteBaker 2.12.2 allows SQL Injection via parameter 'display_name' in /websitebaker/admin/preferences/save.php. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Max CVSS
9.8
EPSS Score
0.47%
Published
2020-10-01
Updated
2020-10-05
Multiple persistent stored Cross-Site-Scripting (XSS) vulnerabilities in the files /wb/admin/admintools/tool.php (Droplet Description) and /install/index.php (Site Title) in WebsiteBaker 2.10.0 allow attackers to insert persistent JavaScript code that gets reflected back to users in multiple areas in the application.
Max CVSS
6.1
EPSS Score
0.08%
Published
2018-01-10
Updated
2018-02-01
install\save.php in WebsiteBaker v2.10.0 allows remote attackers to execute arbitrary PHP code via the database_username, database_host, or database_password parameter.
Max CVSS
9.8
EPSS Score
0.50%
Published
2017-06-21
Updated
2017-11-07
WebsiteBaker v2.10.0 has a stored XSS vulnerability in /account/details.php.
Max CVSS
6.1
EPSS Score
0.08%
Published
2017-06-02
Updated
2017-06-06
WebsiteBaker v2.10.0 has a SQL injection vulnerability in /account/details.php.
Max CVSS
9.8
EPSS Score
0.14%
Published
2017-06-02
Updated
2017-06-06
Multiple SQL injection vulnerabilities in account/signup.php and account/signup2.php in WebsiteBaker 2.10.0 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) username, (2) display_name parameter.
Max CVSS
9.8
EPSS Score
0.67%
Published
2017-04-03
Updated
2020-07-07
Cross-site scripting (XSS) vulnerability in admin/pages/modify.php in WebsiteBaker 2.8.3 SP3 allows remote attackers to inject arbitrary web script or HTML via the page_id parameter.
Max CVSS
4.3
EPSS Score
7.83%
Published
2015-01-21
Updated
2015-01-22
Multiple cross-site scripting (XSS) vulnerabilities in WebsiteBaker 2.8.3 allow remote attackers to inject arbitrary web script or HTML via the (1) QUERY_STRING to wb/admin/admintools/tool.php or (2) section_id parameter to edit_module_files.php, (3) news/add_post.php, (4) news/modify_group.php, (5) news/modify_post.php, or (6) news/modify_settings.php in wb/modules/.
Max CVSS
4.3
EPSS Score
0.21%
Published
2014-12-03
Updated
2014-12-05
SQL injection vulnerability in admin/pages/modify.php in WebsiteBaker 2.8.3 allows remote attackers to execute arbitrary SQL commands via the page_id parameter.
Max CVSS
7.5
EPSS Score
0.12%
Published
2014-12-03
Updated
2014-12-05
websitebaker prior to and including 2.8.1 has an authentication error in backup module.
Max CVSS
7.5
EPSS Score
0.17%
Published
2020-01-21
Updated
2020-01-29
A Cross Site Request Forgery (CSRF) vulnerability exists in the administrator functions in WebsiteBaker 2.8.1 and earlier due to inadequate confirmation for sensitive transactions.
Max CVSS
8.8
EPSS Score
0.09%
Published
2020-01-14
Updated
2020-01-17
An Arbitrary File Upload vulnerability exists in admin/media/upload.php in WebsiteBaker 2.8.1 and earlier due to a failure to restrict uploaded files with .htaccess, .php4, .php5, and .phtl extensions.
Max CVSS
7.2
EPSS Score
0.11%
Published
2020-01-14
Updated
2020-01-21
12 vulnerabilities found