Gambio

Records10All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical3CVSS 9.0–10.0

CVSS high3CVSS 7.0–8.9

Exploited now

Gambio records in CISA KEV

No Gambio vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Gambio 5 records HIGH Gambio Gx 4 records LOW Xt 1 record LOW

Records

5 records in Gambio · all components

TI-2024-15761 CVE-2024-23761 · GHSA-c5vv-2cvx-x67j

Server Side Template Injection in Gambio 4.9.2.0 allows attackers to run arbitrary code…

HIGH 82

Server Side Template Injection in Gambio 4.9.2.0 allows attackers to run arbitrary code via crafted smarty email template.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00659 Published 2024-02-12 No fix listed CWE-918

TI-2024-15759 CVE-2024-23759 · GHSA-f9xc-7r8v-hf32

Deserialization of Untrusted Data in Gambio through 4.9.2.0 allows attackers to run…

HIGH 73

Deserialization of Untrusted Data in Gambio through 4.9.2.0 allows attackers to run arbitrary code via "search" parameter of the Parcelshopfinder/AddAddressBookEntry" function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.47549 Published 2024-02-12 No fix listed CWE-502

TI-2024-15763 CVE-2024-23763 · GHSA-mqpg-qh9p-8qwv

SQL Injection vulnerability in Gambio through 4.9.2.0 allows attackers to run arbitrary…

MEDIUM 50

SQL Injection vulnerability in Gambio through 4.9.2.0 allows attackers to run arbitrary SQL commands via crafted GET request using modifiers[attribute][] parameter.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00629 Published 2024-02-12 No fix listed CWE-89

TI-2024-15762 CVE-2024-23762 · GHSA-9h2p-2c35-fq37

Unrestricted File Upload vulnerability in Content Manager feature in Gambio 4.9.2.0…

LOW 36

Unrestricted File Upload vulnerability in Content Manager feature in Gambio 4.9.2.0 allows attackers to execute arbitrary code via upload of crafted PHP file.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00322 Published 2024-02-12 No fix listed CWE-434

TI-2024-15760 CVE-2024-23760 · GHSA-2j3h-78mv-5phm

Cleartext Storage of Sensitive Information in Gambio 4.9.2.0 allows attackers to obtain…

LOW 14

Cleartext Storage of Sensitive Information in Gambio 4.9.2.0 allows attackers to obtain sensitive information via error-handler.log.json and legacy-error-handler.log.txt under the webroot.

CVSS 3.1LOW 2.7 Network High privileges No interaction EPSS 0.00442 Published 2024-02-12 No fix listed CWE-532

Open these records in search →

Critical	3
High	3
Medium	3
Low	1
No CVSS	0