Gambio

Records10All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical3CVSS 9.0–10.0

CVSS high3CVSS 7.0–8.9

Exploited now

Gambio records in CISA KEV

No Gambio vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Gambio 5 records HIGH Gambio Gx 4 records LOW Xt 1 record LOW

Records

10 records

TI-2024-15761 CVE-2024-23761 · GHSA-c5vv-2cvx-x67j

Server Side Template Injection in Gambio 4.9.2.0 allows attackers to run arbitrary code…

HIGH 82

Server Side Template Injection in Gambio 4.9.2.0 allows attackers to run arbitrary code via crafted smarty email template.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00659 Published 2024-02-12 No fix listed CWE-918

TI-2024-15759 CVE-2024-23759 · GHSA-f9xc-7r8v-hf32

Deserialization of Untrusted Data in Gambio through 4.9.2.0 allows attackers to run…

HIGH 73

Deserialization of Untrusted Data in Gambio through 4.9.2.0 allows attackers to run arbitrary code via "search" parameter of the Parcelshopfinder/AddAddressBookEntry" function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.47549 Published 2024-02-12 No fix listed CWE-502

TI-2024-15763 CVE-2024-23763 · GHSA-mqpg-qh9p-8qwv

SQL Injection vulnerability in Gambio through 4.9.2.0 allows attackers to run arbitrary…

MEDIUM 50

SQL Injection vulnerability in Gambio through 4.9.2.0 allows attackers to run arbitrary SQL commands via crafted GET request using modifiers[attribute][] parameter.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00629 Published 2024-02-12 No fix listed CWE-89

TI-2020-08860 CVE-2020-10984 · GHSA-p3w6-4fw6-pj7x

Gambio GX before 4.0.1.0 allows admin/admin.php CSRF.

LOW 39

Gambio GX before 4.0.1.0 allows admin/admin.php CSRF.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00715 Published 2020-07-28 No fix listed CWE-352

TI-2024-15762 CVE-2024-23762 · GHSA-9h2p-2c35-fq37

Unrestricted File Upload vulnerability in Content Manager feature in Gambio 4.9.2.0…

LOW 36

Unrestricted File Upload vulnerability in Content Manager feature in Gambio 4.9.2.0 allows attackers to execute arbitrary code via upload of crafted PHP file.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00322 Published 2024-02-12 No fix listed CWE-434

TI-2010-04677 CVE-2010-4954 · GHSA-7p42-q79x-fm9g

SQL injection vulnerability in product_reviews_info.php in xt:Commerce Gambio 2008 allows…

LOW 35

SQL injection vulnerability in product_reviews_info.php in xt:Commerce Gambio 2008 allows remote attackers to execute arbitrary SQL commands via the products_id parameter.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.00986 Published 2011-10-09 No fix listed CWE-89

TI-2020-08859 CVE-2020-10983 · GHSA-g2pj-29c7-96vw

Gambio GX before 4.0.1.0 allows SQL Injection in admin/mobile.php.

LOW 25

Gambio GX before 4.0.1.0 allows SQL Injection in admin/mobile.php.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.014 Published 2020-07-28 No fix listed CWE-89

TI-2020-08858 CVE-2020-10982 · GHSA-j2gp-5gr4-5w9f

Gambio GX before 4.0.1.0 allows SQL Injection in admin/gv_mail.php.

LOW 25

Gambio GX before 4.0.1.0 allows SQL Injection in admin/gv_mail.php.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.01371 Published 2020-07-28 No fix listed CWE-89

TI-2020-08861 CVE-2020-10985 · GHSA-m2cj-gv2p-qwgr

Gambio GX before 4.0.1.0 allows XSS in admin/coupon_admin.php.

LOW 23

Gambio GX before 4.0.1.0 allows XSS in admin/coupon_admin.php.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00598 Published 2020-07-28 No fix listed CWE-79

TI-2024-15760 CVE-2024-23760 · GHSA-2j3h-78mv-5phm

Cleartext Storage of Sensitive Information in Gambio 4.9.2.0 allows attackers to obtain…

LOW 14

Cleartext Storage of Sensitive Information in Gambio 4.9.2.0 allows attackers to obtain sensitive information via error-handler.log.json and legacy-error-handler.log.txt under the webroot.

CVSS 3.1LOW 2.7 Network High privileges No interaction EPSS 0.00442 Published 2024-02-12 No fix listed CWE-532

Open these records in search →

Critical	3
High	3
Medium	3
Low	1
No CVSS	0