Vendors / Lepton-cms Records 13 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 0
CVSS high 7
Exploited now Lepton-cms records in CISA KEV No Lepton-cms vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority HIGH 73
LeptonCMS version 7.3.0 contains an arbitrary file upload vulnerability, which is caused by the lack of proper validation for uploaded files.
CVSS 3.1 HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00766 · Published 2025-12-09 · No fix listed CWE-434
Priority HIGH 73
File Upload vulnerability in lepton v.7.1.0 allows a remote authenticated attackers to execute arbitrary code via uploading a crafted PHP file to the save.php and config.php component.
CVSS 3.1 HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01164 · Published 2024-03-25 · No fix listed CWE-434
Priority HIGH 73
File Upload vulnerability in lepton v.7.1.0 allows a remote authenticated attackers to execute arbitrary code via uploading a crafted PHP file.
CVSS 3.1 HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01281 · Published 2024-04-02 · No fix listed CWE-434
Priority HIGH 69
An issue in Lepton CMS v.7.0.0 allows a local attacker to execute arbitrary code via the upgrade.php file in the languages place.
CVSS 3.1 HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00421 · Published 2024-02-29 · No fix listed CWE-94
Priority HIGH 67
An arbitrary file upload vulnerability in LEPTON v7.0.0 allows authenticated attackers to execute arbitrary PHP code by uploading this code to the backend/languages/index.php languages area.
CVSS 3.1 HIGH 7.2· Network · High privileges · No interaction · EPSS 0.15597 · Published 2024-01-25 · No fix listed CWE-434
Priority LOW 28
Cross Site Scripting (XSS) vulnerability in backend/pages/modify.php in Lepton-CMS version 4.7.0, allows remote attackers to execute arbitrary code.
CVSS 3.1 MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00509 · Published 2023-08-11 · No fix listed CWE-79
Priority LOW 28
Multiple cross-site scripting (XSS) vulnerabilities exist in LeptonCMS before 4.6.0.
CVSS 3.1 MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00641 · Published 2020-05-07 · No fix listed CWE-79
Priority LOW 25
Lepton-CMS 4.7.0 is affected by cross-site scripting (XSS).
CVSS 3.1 MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.01693 · Published 2020-12-02 · No fix listed CWE-79
Open these records in search → All records by CVSS severity
0 7 6 0 0
THREATIST.IORead the docs