Vendors / Indexhibit Records 8 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 1
CVSS high 2
Exploited now Indexhibit records in CISA KEV No Indexhibit vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority HIGH 69
Indexhibit 2.1.5 allows a product reinstallation, with resultant remote code execution, via /ndxzstudio/install.php?p=2.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.38732 · Published 2019-09-14 · No fix listed
Priority MEDIUM 43
In Indexhibit 2.1.5, remote attackers can execute arbitrary code via the v parameter (in conjunction with the id parameter) in a upd_jxcode=true action to the ndxzstudio/?a=system URI.
CVSS 3.0 HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.02695 · Published 2019-02-20 · No fix listed CWE-20
Priority MEDIUM 40
A configuration issue in Indexhibit 2.1.5 allows authenticated attackers to modify .php files, leading to getshell.
CVSS 3.1 HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00969 · Published 2021-08-30 · No fix listed CWE-732
Priority LOW 31
An issue in the /config/config.php component of Indexhibit 2.1.5 allows attackers to arbitrarily view files.
CVSS 3.1 MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.01172 · Published 2021-08-30 · No fix listed CWE-22
Priority LOW 29
A cross-site request forgery (CSRF) vulnerability in Indexhibit 2.1.5 allows attackers to arbitrarily delete admin accounts.
CVSS 3.1 MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.00425 · Published 2021-08-30 · No fix listed CWE-352
Priority LOW 28
A reflected cross-site scripting (XSS) vulnerability in the /plugin/ajax.php component of Indexhibit 2.1.5 allows attackers to execute arbitrary web scripts or HTML.
CVSS 3.1 MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00574 · Published 2021-08-30 · No fix listed CWE-79
Priority LOW 26
A cross-site request forgery (CSRF) vulnerability in Indexhibit 2.1.5 allows attackers to arbitrarily reset account passwords.
CVSS 3.1 MEDIUM 5.7· Network · Low privileges · User interaction · EPSS 0.00355 · Published 2021-08-30 · No fix listed CWE-352
Priority LOW 25
Multiple stored cross-site scripting (XSS) vulnerabilities in the Sections module of Indexhibit 2.1.5 allows attackers to execute arbitrary web scripts or HTML.
CVSS 3.1 MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00503 · Published 2021-08-30 · No fix listed CWE-79
Open these records in search → All records by CVSS severity
1 2 5 0 0
THREATIST.IORead the docs