Vendors / Thinksaas Records 12 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 2
CVSS high 0
Exploited now Thinksaas records in CISA KEV No Thinksaas vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority HIGH 82
ThinkSAAS v3.7.0 was discovered to contain a SQL injection vulnerability via the name parameter at \system\action\update.php.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.0051 · Published 2024-07-16 · No fix listed CWE-89
Priority MEDIUM 60
A stored cross-site scripting (XSS) vulnerability in the component /action/anti.php of ThinkSAAS v3.7.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the word parameter.
CVSS 3.1 MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00394 · Published 2024-04-30 · No fix listed CWE-79
Priority MEDIUM 58
A stored cross-site scripting (XSS) vulnerability in the component /pubs/counter.php of ThinkSAAS v3.7.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the code parameter.
CVSS 3.1 MEDIUM 5.4· Network · No auth · User interaction · EPSS 0.00394 · Published 2024-04-30 · No fix listed CWE-79
Priority MEDIUM 57
A vulnerability, which was classified as problematic, has been found in ThinkSAAS 3.7.0.
CVSS 4.0 MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00439 · Published 2024-07-21 · No fix listed CWE-79
Priority MEDIUM 47
An arbitrary file deletion vulnerability in ThinkSAAS v3.7 allows attackers to delete arbitrary files via a crafted request.
CVSS 3.1 LOW 2.7· Network · High privileges · No interaction · EPSS 0.00248 · Published 2024-07-16 · No fix listed CWE-352
Priority MEDIUM 46
ThinkSAAS before 3.38 contains a SQL injection vulnerability through app/topic/action/admin/topic.php via the title parameter, which allows remote attackers to execute arbitrary SQL commands.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01945 · Published 2021-03-24 · No fix listed CWE-89
Priority LOW 29
An issue was discovered in ThinkSAAS 2.91.
CVSS 3.1 MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00749 · Published 2019-09-21 · No fix listed CWE-79
Priority LOW 26
Improper Authorization in ThinkSAAS v2.7 allows remote attackers to modify the description of any user's photo via the "photoid%5B%5D" and "photodesc%5B%5D" parameters in the component "index.php?app=photo."
CVSS 3.1 MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.0094 · Published 2021-07-08 · No fix listed
Priority LOW 26
ThinkSAAS through 2018-07-25 has XSS via the index.php?app=group&ac=create&ts=do groupdesc parameter.
CVSS 3.0 MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00667 · Published 2018-08-07 · No fix listed CWE-79
Priority LOW 26
ThinkSAAS through 2018-07-25 has XSS via the index.php?app=article&ac=comment&ts=do content parameter.
CVSS 3.0 MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00667 · Published 2018-08-07 · No fix listed CWE-79
Priority LOW 24
A vulnerability, which was classified as problematic, was found in ThinkSAAS 3.7.0.
CVSS 4.0 MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.0043 · Published 2024-07-21 · No fix listed CWE-79
Priority LOW 23
An issue was discovered in ThinkSAAS 2.91.
CVSS 3.1 MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.00592 · Published 2019-09-21 · No fix listed CWE-79
Open these records in search → All records by CVSS severity
2 0 9 1 0
THREATIST.IORead the docs