Webedition

Records8All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high2CVSS 7.0–8.9

Exploited now

Webedition records in CISA KEV

No Webedition vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Webedition Cms 7 records HIGH Webedition 1 record LOW

Records

7 records in Webedition Cms · all components

TI-2023-30166 CVE-2023-53883 · GHSA-6cfr-35cv-65w6

Webedition CMS v2.9.8.8 Remote Code Execution via PHP Page Creation

HIGH 72

Webedition CMS v2.9.8.8 contains a remote code execution vulnerability that allows authenticated attackers to inject system commands through PHP page creation.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.00999 Published 2025-12-15 No fix listed CWE-94

TI-2024-18867 CVE-2024-28418 · GHSA-gvvj-6354-3j8f

Webedition CMS 9.2.2.0 has a File upload vulnerability via /webEdition/we_cmd.php

MEDIUM 62

Webedition CMS 9.2.2.0 has a File upload vulnerability via /webEdition/we_cmd.php

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0044 Published 2024-03-14 No fix listed CWE-434

TI-2024-18866 CVE-2024-28417 · GHSA-2pm2-cpjx-462g

Webedition CMS 9.2.2.0 has a Stored XSS vulnerability via /webEdition/we_cmd.php.

MEDIUM 61

Webedition CMS 9.2.2.0 has a Stored XSS vulnerability via /webEdition/we_cmd.php.

CVSS 3.1MEDIUM 6.3 Network No auth User interaction EPSS 0.00347 Published 2024-03-14 No fix listed CWE-80

TI-2023-30167 CVE-2023-53884 · GHSA-557f-ppxv-gpgc

Webedition CMS v2.9.8.8 Stored Cross-Site Scripting via SVG Upload

MEDIUM 56

Webedition CMS v2.9.8.8 contains a stored cross-site scripting vulnerability that allows authenticated users to upload malicious SVG files with embedded JavaScript.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00275 Published 2025-12-15 No fix listed CWE-79

TI-2014-01825 CVE-2014-2302 · GHSA-47f3-j862-735c

The installer script in webEdition CMS before 6.2.7-s1 and 6.3.x before 6.3.8-s1 allows…

MEDIUM 49

The installer script in webEdition CMS before 6.2.7-s1 and 6.3.x before 6.3.8-s1 allows remote attackers to conduct PHP Object Injection attacks by intercepting a request to update.webedition.org.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.04467 Published 2018-07-19 No fix listed CWE-94

TI-2014-04293 CVE-2014-5258 · GHSA-cr98-j6fv-34rq

Directory traversal vulnerability in showTempFile.php in webEdition CMS before 6.3.9.0…

LOW 38

Directory traversal vulnerability in showTempFile.php in webEdition CMS before 6.3.9.0 Beta allows remote authenticated users to read arbitrary files via a ..

CVSS 2.0MEDIUM 4.0 Network Low privileges Interaction — EPSS 0.20326 Published 2014-11-06 No fix listed CWE-22

TI-2014-01826 CVE-2014-2303 · GHSA-rjjg-6x7j-qmpc

Multiple SQL injection vulnerabilities in the file browser component (we_fs.php) in…

LOW 38

Multiple SQL injection vulnerabilities in the file browser component (we_fs.php) in webEdition CMS before 6.2.7-s1.2 and 6.3.x through 6.3.8 before -s1 allow remote attackers to execute arbitrary SQL commands via the (1)…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.0257 Published 2014-06-13 No fix listed CWE-89

Open these records in search →

Critical	1
High	2
Medium	5
Low	0
No CVSS	0