Vendors / Bosscms Records 5 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 1
CVSS high 2
Exploited now Bosscms records in CISA KEV No Bosscms vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority HIGH 69
Insecure Permissions vulnerability in BossCMS v.1.3.0 allows a local attacker to execute arbitrary code and escalate privileges via the init function in admin.class.php component.
CVSS 3.1 HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.0031 · Published 2024-01-30 · No fix listed CWE-863
Priority MEDIUM 64
Cross Site Scripting (XSS) vulnerability in BOSSCMS v3.10 allows attackers to run arbitrary code via the header code and footer code fields in code configuration.
CVSS 3.1 HIGH 7.1· Network · No auth · User interaction · EPSS 0.00373 · Published 2024-04-25 · No fix listed CWE-79
Priority MEDIUM 62
Bosscms v2.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Add function under the Administrator List module.
CVSS 3.1 MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.00297 · Published 2022-11-28 · No fix listed CWE-352
Priority MEDIUM 58
BOSSCMS v3.10 is vulnerable to Cross Site Request Forgery (CSRF) in name="head_code" or name="foot_code."
CVSS 3.1 MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00165 · Published 2024-06-10 · No fix listed CWE-352
Priority MEDIUM 45
An arbitrary file upload vulnerability exists in Wenzhou Huoyin Information Technology Co., Ltd.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01503 · Published 2022-05-05 · No fix listed CWE-434
Open these records in search → All records by CVSS severity
1 2 2 0 0
THREATIST.IORead the docs