Enhavo

Records5All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high0CVSS 7.0–8.9

Exploited now

Enhavo records in CISA KEV

No Enhavo vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Enhavo 5 records MEDIUM

Records

5 records

TI-2024-16990 CVE-2024-25875 · GHSA-c579-hhw5-cr3p

A cross-site scripting (XSS) vulnerability in the Header module of Enhavo CMS v0.13.1…

MEDIUM 62

A cross-site scripting (XSS) vulnerability in the Header module of Enhavo CMS v0.13.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Undertitle text field.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00424 Published 2024-02-22 No fix listed CWE-79

TI-2024-16989 CVE-2024-25874 · GHSA-38m8-5gfc-663g

A cross-site scripting (XSS) vulnerability in the New/Edit Article module of Enhavo CMS…

MEDIUM 58

A cross-site scripting (XSS) vulnerability in the New/Edit Article module of Enhavo CMS v0.13.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Create Tag text field.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00397 Published 2024-02-22 No fix listed CWE-79

TI-2024-16988 CVE-2024-25873 · GHSA-v57p-q7g2-4g2r

Enhavo v0.13.1 was discovered to contain an HTML injection vulnerability in the Author…

MEDIUM 58

Enhavo v0.13.1 was discovered to contain an HTML injection vulnerability in the Author text field under the Blockquote module.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00482 Published 2024-02-22 No fix listed CWE-80

TI-2024-16991 CVE-2024-25876 · GHSA-pcm8-qqrp-w6qf

A cross-site scripting (XSS) vulnerability in the Header module of Enhavo CMS v0.13.1…

LOW 28

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00443 Published 2024-02-22 No fix listed CWE-79

TI-2018-06374 CVE-2018-8832 · GHSA-mfff-c82j-42cq

enhavo 0.4.0 has XSS via a user-group that contains executable JavaScript code in the…

LOW 23

enhavo 0.4.0 has XSS via a user-group that contains executable JavaScript code in the user-group name.

CVSS 3.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00615 Published 2018-03-20 No fix listed CWE-79

Open these records in search →

Critical	0
High	0
Medium	5
Low	0
No CVSS	0