Read the docs

thirty bees

Records4All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high0CVSS 7.0–8.9

Exploited now

thirty bees records in CISA KEV

No thirty bees vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Thirty Bees 2 records LOW Bees Blog 1 record LOW

Records

4 records

TI-2026-71030 CVE-2026-109394 · GHSA-p3f5-mhgv-c337

Account takeover in thirty bees via guest checkout password reset

Priority HIGH 74

Thirty bees through 1.7.0 contains an authentication bypass vulnerability in PasswordController::resolveCustomer() that allows unauthenticated attackers to reset registered customers' passwords using guest account tokens…

CVSS 4.0CRITICAL 9.1 Network No auth No interaction EPSS 0.00446 Published 2026-10-12 No fix listed CWE-639
TI-2023-24672 CVE-2023-45957 · GHSA-jjvp-fh9w-628p

A stored cross-site scripting (XSS) vulnerability in the component…

Priority LOW 25

A stored cross-site scripting (XSS) vulnerability in the component admin/AdminRequestSqlController.php of thirty bees before 1.5.0 allows attackers to execute arbitrary web script or HTML via $e->getMessage() error misha…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00375 Published 2023-12-22 No fix listed CWE-79
Open these records in search →