Vulnerabilities

TI-2021-21191 CVE-2021-46360 · GHSA-45x9-545x-8mc3

Authenticated remote code execution (RCE) in Composr-CMS 10.0.39 and earlier allows…

MEDIUM 50

Authenticated remote code execution (RCE) in Composr-CMS 10.0.39 and earlier allows remote attackers to execute arbitrary code via uploading a PHP shell through /adminzone/index.php?page=admin-commandr.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.09183 Published 2022-02-09 No fix listed CWE-434

TI-2021-10690 CVE-2021-30149 · GHSA-92hj-gmm8-c8gc

Composr 10.0.36 allows upload and execution of PHP files.

MEDIUM 54

Composr 10.0.36 allows upload and execution of PHP files.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.10064 Published 2021-04-06 No fix listed CWE-434

TI-2021-10691 CVE-2021-30150 · GHSA-g6rj-5gx9-22vr

Composr 10.0.36 allows XSS in an XML script.

LOW 32

Composr 10.0.36 allows XSS in an XML script.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.02775 Published 2021-04-06 No fix listed CWE-79

Vulnerabilities

Filters

Authenticated remote code execution (RCE) in Composr-CMS 10.0.39 and earlier allows…

Composr 10.0.36 allows upload and execution of PHP files.

Composr 10.0.36 allows XSS in an XML script.