X2engine

Records15All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high4CVSS 7.0–8.9

Exploited now

X2engine records in CISA KEV

No X2engine vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

X2crm 13 records MEDIUM X2engine 2 records LOW

Records

2 records in X2engine · all components

TI-2014-04322 CVE-2014-5297 · GHSA-8pcr-qrf2-5hpg

The actionSendErrorReport method in protected/controllers/SiteController.php in X2Engine…

LOW 38

The actionSendErrorReport method in protected/controllers/SiteController.php in X2Engine 2.8 through 4.1.7 allows remote attackers to conduct PHP object injection and Server-Side Request Forgery (SSRF) attacks via crafte…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.02671 Published 2014-10-10 No fix listed CWE-94

TI-2014-04323 CVE-2014-5298 · GHSA-8jfm-3q68-9546

FileUploadsFilter.php in X2Engine 4.1.7 and earlier, when running on case-insensitive…

LOW 28

FileUploadsFilter.php in X2Engine 4.1.7 and earlier, when running on case-insensitive file systems, allows remote attackers to bypass the upload blacklist and conduct unrestricted file upload attacks by uploading a file…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.03002 Published 2014-10-10 No fix listed CWE-264

Open these records in search →

Critical	0
High	4
Medium	11
Low	0
No CVSS	0