Croogo

Records13All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high1CVSS 7.0–8.9

Exploited now

Croogo records in CISA KEV

No Croogo vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Croogo 12 records HIGH

Records

13 records

TI-2024-19484 CVE-2024-29643 · GHSA-847x-x4jg-6gf4

An issue in croogo v.3.0.2 allows an attacker to perform Host header injection via the feed.rss component.

HIGH 80

An issue in croogo v.3.0.2 allows an attacker to perform Host header injection via the feed.rss component.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00584 Published 2025-04-18 No fix listed CWE-444

TI-2024-28584 CVE-2024-42718 · GHSA-g5p6-3j82-xfm4

A path traversal vulnerability in Croogo CMS 4.0.7 allows remote attackers to read…

MEDIUM 62

A path traversal vulnerability in Croogo CMS 4.0.7 allows remote attackers to read arbitrary files via a specially crafted path in the 'edit-file' parameter.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00649 Published 2025-12-26 No fix listed CWE-22

TI-2026-13560 CVE-2026-16219 · GHSA-mwrx-jx87-85xc

Croogo CMS Admin File Manager FileManager.php isEditable path traversal

MEDIUM 57

A flaw has been found in Croogo CMS up to 4.0.7.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00425 Published 2026-07-19 No fix listed CWE-22

TI-2021-20199 CVE-2021-44673 · GHSA-4pww-fqgh-36hj

A Remote Code Execution (RCE) vulnerability exists in Croogo 3.0.2via…

MEDIUM 50

A Remote Code Execution (RCE) vulnerability exists in Croogo 3.0.2via admin/file-manager/attachments, which lets a malicoius user upload a web shell script.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.08963 Published 2022-03-10 No fix listed CWE-434

TI-2014-07043 CVE-2014-8577 · GHSA-w972-cgx5-m42r

Multiple cross-site scripting (XSS) vulnerabilities in Croogo before 2.1.0 allow remote…

LOW 27

Multiple cross-site scripting (XSS) vulnerabilities in Croogo before 2.1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) data[Contact][title] parameter to admin/contacts/contacts/add page; (2)…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.0425 Published 2014-10-31 No fix listed CWE-79

TI-2017-14718 CVE-2017-1000510 · GHSA-r4h9-gv2m-9x97

Croogo version 2.3.1-17-g6f82e6c contains a Cross Site Scripting (XSS) vulnerability in…

LOW 26

Croogo version 2.3.1-17-g6f82e6c contains a Cross Site Scripting (XSS) vulnerability in Page name that can result in execution of javascript code.

CVSS 3.0MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00755 Published 2018-02-09 Fixed in 4.0.0 CWE-79

TI-2015-00948 CVE-2015-1053 · GHSA-gf5f-3v3v-w9wh

Cross-site scripting (XSS) vulnerability in the administrative backend in Croogo before…

LOW 24

Cross-site scripting (XSS) vulnerability in the administrative backend in Croogo before 2.2.1 allows remote attackers to inject arbitrary web script or HTML via the path parameter to admin/file_manager/file_manager/editf…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.02214 Published 2015-01-16 No fix listed CWE-79

TI-2019-15009 CVE-2019-20789 · GHSA-jfvf-rfmq-qwf8

Croogo before 3.0.7 allows XSS via the title to admin/menus/menus or admin/taxonomy/vocabularies.

LOW 23

Croogo before 3.0.7 allows XSS via the title to admin/menus/menus or admin/taxonomy/vocabularies.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00733 Published 2020-04-26 Fixed in 3.0.7 CWE-79

TI-2019-05090 CVE-2019-7173 · GHSA-q5fg-v5p7-r424

A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML…

LOW 23

A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /admin/file-manager/attachments/edit/4.