TI-2011-02588 CVE-2011-2936 · GHSA-33qp-rrww-3f5q
Elgg through 1.7.10 has a SQL injection vulnerability
Priority MEDIUM 45
Elgg through 1.7.10 has a SQL injection vulnerability
Elgg
Records12All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9
Exploited now
Elgg records in CISA KEVNo Elgg vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
12 records
TI-2021-02877 CVE-2021-3980 · GHSA-hx6g-q9v2-xh7v
Exposure of Private Personal Information to an Unauthorized Actor in elgg/elgg
Priority LOW 36
elgg is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor
TI-2012-05280 CVE-2012-6562 · GHSA-wx93-8gv6-wmq3
engine/lib/users.php in Elgg before 1.8.5 does not properly specify permissions for the…
Priority LOW 33
engine/lib/users.php in Elgg before 1.8.5 does not properly specify permissions for the useradd action, which allows remote attackers to create arbitrary accounts.
TI-2019-08233 CVE-2019-11016 · GHSA-r6h7-846c-8m78
Elgg before 1.12.18 and 2.3.x before 2.3.11 has an open redirect.
Priority LOW 30
Elgg before 1.12.18 and 2.3.x before 2.3.11 has an open redirect.
TI-2011-02587 CVE-2011-2935 · GHSA-mcfm-j5g6-w26f
Elgg through 1.7.10 has XSS
Priority LOW 29
Elgg through 1.7.10 has XSS
TI-2021-02861 CVE-2021-3964 · GHSA-gwpx-q2h9-wxgx
Authorization Bypass Through User-Controlled Key in elgg/elgg
Priority LOW 28
elgg is vulnerable to Authorization Bypass Through User-Controlled Key
TI-2021-02956 CVE-2021-4072 · GHSA-2xw8-j43j-5vxp
Cross-site Scripting (XSS) - Stored in elgg/elgg
Priority LOW 26
elgg is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
TI-2011-03290 CVE-2011-3733 · GHSA-mv23-rj4p-fj75
Elgg 1.7.6 allows remote attackers to obtain sensitive information via a direct request…
Priority LOW 26
Elgg 1.7.6 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by vendors/simpletest/test/visual_test.php…
TI-2013-00168 CVE-2013-0234 · GHSA-p9w9-349j-r85v
Cross-site scripting (XSS) vulnerability in the Twitter widget in Elgg before 1.7.17 and…
Priority LOW 23
Cross-site scripting (XSS) vulnerability in the Twitter widget in Elgg before 1.7.17 and 1.8.x before 1.8.13 allows remote attackers to inject arbitrary web script or HTML via the params[twitter_username] parameter to ac…
TI-2012-05281 CVE-2012-6563 · GHSA-qq49-hmp5-gwv6
engine/lib/access.php in Elgg before 1.8.5 does not properly clear cached access lists…
Priority LOW 23
engine/lib/access.php in Elgg before 1.8.5 does not properly clear cached access lists during plugin boot, which allows remote attackers to read private entities via unspecified vectors.
TI-2012-05279 CVE-2012-6561 · GHSA-c3hw-j754-x5g9
Cross-site scripting (XSS) vulnerability in engine/lib/views.php in Elgg before 1.8.5…
Priority LOW 22
Cross-site scripting (XSS) vulnerability in engine/lib/views.php in Elgg before 1.8.5 allows remote attackers to inject arbitrary web script or HTML via the view parameter to index.php.
TI-2026-46797 CVE-2026-65650 · GHSA-7983-35fr-8qwm
Elgg before 7.0.0 does not check image dimensions to prevent denial of service via a large avatar upload.
Priority LOW 20
Elgg before 7.0.0 does not check image dimensions to prevent denial of service via a large avatar upload.