Vendors / Ens Records 7 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 3
CVSS high 2
Exploited now Ens records in CISA KEV No Ens vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority MEDIUM 61
subscriber.php in Webgalamb through 7.0 is vulnerable to SQL injection via the Client-IP HTTP request header.
CVSS 3.0 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.19992 · Published 2019-03-17 · No fix listed CWE-89
Priority MEDIUM 50
In Webgalamb through 7.0, an arbitrary code execution vulnerability could be exploited remotely without authentication.
CVSS 3.0 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.04929 · Published 2019-03-17 · No fix listed CWE-434
Priority MEDIUM 47
In Webgalamb through 7.0, system/ajax.php functionality is supposed to be available only to the administrator.
CVSS 3.0 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02906 · Published 2019-03-17 · No fix listed CWE-863
Priority MEDIUM 42
In Webgalamb through 7.0, a system/ajax.php "wgmfile restore" directory traversal vulnerability could lead to arbitrary code execution by authenticated administrator users, because PHP files are restored under the docume…
CVSS 3.0 HIGH 7.2· Network · High privileges · No interaction · EPSS 0.07228 · Published 2019-03-17 · No fix listed CWE-22
Priority LOW 37
In Webgalamb through 7.0, log files are exposed to the internet with predictable files/logs/sql_error_log/YYYY-MM-DD-sql_error_log.log filenames.
CVSS 3.0 HIGH 7.5· Network · No auth · No interaction · EPSS 0.02124 · Published 2019-03-17 · No fix listed CWE-532
Priority LOW 30
wg7.php in Webgalamb 7.0 lacks security measures to prevent CSRF attacks, as demonstrated by wg7.php?options=1 to change the administrator password.
CVSS 3.0 MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.00727 · Published 2019-03-17 · No fix listed CWE-352
Priority LOW 29
wg7.php in Webgalamb 7.0 makes opportunistic calls to htmlspecialchars() instead of using a templating engine with proper contextual encoding.
CVSS 3.0 MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.01058 · Published 2019-03-17 · No fix listed CWE-79
Open these records in search → All records by CVSS severity
3 2 2 0 0
THREATIST.IORead the docs