Vendors / Xpressengine Records 5 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 2
CVSS high 0
Exploited now Xpressengine records in CISA KEV No Xpressengine vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority MEDIUM 51
When uploading an image file to a bulletin board developed with XpressEngine, a vulnerability in which an arbitrary file can be uploaded due to insufficient verification of the file.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.0121 · Published 2023-01-20 · Fixed in 3.0.15 CWE-434
Priority MEDIUM 43
A vulnerability was found in XpressEngine up to 1.4.4.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00608 · Published 2023-02-07 · No fix listed CWE-89
Priority LOW 25
In XE 1.116, when uploading the Normal button, there is no restriction on the file suffix, which leads to any file uploading to the files directory.
CVSS 3.1 MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00487 · Published 2022-02-09 · No fix listed CWE-79
Priority LOW 25
XE before 1.11.6 is vulnerable to Unrestricted file upload via modules/menu/menu.admin.controller.php.
CVSS 3.1 MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00569 · Published 2022-02-09 · No fix listed CWE-79
Open these records in search → All records by CVSS severity
2 0 3 0 0
THREATIST.IORead the docs