Priority MEDIUM 58
AeroCMS v0.0.1 was discovered to contain multiple stored cross-site scripting (XSS) vulnerabilities via the comment_author and comment_content parameters at /post.php.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00384 · Published 2023-04-14 · No fix listed CWE-79
Priority MEDIUM 45
Aero CMS 0.0.1 contains a SQL injection vulnerability in the author parameter that allows attackers to manipulate database queries.
CVSS 4.0HIGH 8.8· Network · No auth · No interaction · EPSS 0.00658 · Published 2026-01-13 · No fix listed CWE-89
Priority MEDIUM 42
AeroCMS v0.0.1 is vulnerable to Directory Traversal.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01485 · Published 2022-12-16 · No fix listed CWE-22
Priority MEDIUM 41
AeroCMS v0.0.1 was discovered to contain an arbitrary file upload vulnerability via the component /admin/profile.php.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01241 · Published 2022-09-13 · No fix listed CWE-434
Priority MEDIUM 40
AeroCMS v0.0.1 was discovered to contain a SQL Injection vulnerability via the p_id parameter at \post.php.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00838 · Published 2022-11-22 · No fix listed CWE-89
Priority MEDIUM 40
AeroCMS v0.0.1 was discovered to contain a SQL Injection vulnerability via the Category parameter at \category.php.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00838 · Published 2022-11-22 · No fix listed CWE-89
Priority MEDIUM 40
AeroCMS v0.0.1 was discovered to contain a SQL Injection vulnerability via the Search parameter.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00816 · Published 2022-11-29 · No fix listed CWE-89
Priority LOW 37
AeroCMS v0.0.1 was discovered to contain an arbitrary file upload vulnerability via the Post Image function under the Admin panel.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.02673 · Published 2022-04-08 · No fix listed CWE-434
Priority LOW 36
In AeroCms v0.0.1, there is an arbitrary file upload vulnerability at /admin/posts.php?source=edit_post , through which we can upload webshell and control the web server.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.01237 · Published 2022-12-16 · No fix listed CWE-434
Priority LOW 35
The approve parameter from the AeroCMS-v0.0.1 CMS system is vulnerable to SQL injection attacks.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.00896 · Published 2022-12-13 · No fix listed CWE-89
Priority LOW 34
AeroCMS 0.1.1 is vulnerable to SQL Injection via the author parameter.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.02681 · Published 2022-08-31 · No fix listed CWE-89
Priority LOW 30
AeroCMS v0.0.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability via view_all_comments.php.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.01466 · Published 2022-04-08 · No fix listed CWE-79
Priority LOW 29
AeroCMS v0.0.1 is vulnerable to Cross Site Request Forgery (CSRF).
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.00343 · Published 2022-12-13 · No fix listed CWE-352
Priority LOW 28
AeroCMS v0.0.1 is vulnerable to ClickJacking.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00489 · Published 2022-12-13 · No fix listed CWE-1021
Priority LOW 26
AeroCMS v0.0.1 was discovered to contain a SQL Injection vulnerability via the id parameter at \admin\post_comments.php.
CVSS 3.1MEDIUM 4.9· Network · High privileges · No interaction · EPSS 0.00894 · Published 2022-11-22 · No fix listed CWE-89
Priority LOW 24
AeroCMS v0.0.1 is vulnerable to SQL Injection via the delete parameter.
CVSS 3.1MEDIUM 4.9· Network · High privileges · No interaction · EPSS 0.00792 · Published 2022-12-13 · No fix listed CWE-89
Priority LOW 24
AeroCMS v0.0.1 was discovered to contain a SQL Injection vulnerability via the edit parameter at \admin\categories.php.
CVSS 3.1MEDIUM 4.9· Network · High privileges · No interaction · EPSS 0.00857 · Published 2022-11-22 · No fix listed CWE-89
Priority LOW 24
AeroCMS v0.0.1 was discovered to contain a SQL Injection vulnerability via the post_category_id parameter at \admin\includes\edit_post.php.
CVSS 3.1MEDIUM 4.9· Network · High privileges · No interaction · EPSS 0.00809 · Published 2022-11-22 · No fix listed CWE-89
Priority LOW 24
AeroCMS v0.0.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability via add_post.php.
CVSS 3.1MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.01099 · Published 2022-04-08 · No fix listed CWE-79
Priority LOW 23
AeroCMS v0.0.1 was discovered to contain a cross-site scripting (XSS) vulnerability via add_post.php.
CVSS 3.1MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.00479 · Published 2022-12-13 · No fix listed CWE-79
THREATIST.IORead the docs