Vulnerabilities

TI-2020-13929 CVE-2020-20797 · GHSA-mmgf-pgg9-wr7j

FlameCMS 3.3.5 contains a time-based blind SQL injection vulnerability in /account/register.php.

MEDIUM 44

FlameCMS 3.3.5 contains a time-based blind SQL injection vulnerability in /account/register.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01116 Published 2021-09-30 No fix listed CWE-89

TI-2020-13928 CVE-2020-20796 · GHSA-26jg-rrff-qqvf

MEDIUM 44

FlameCMS 3.3.5 contains a SQL injection vulnerability in /master/article.php via the "Id" parameter.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00988 Published 2021-09-30 No fix listed CWE-89

TI-2019-12276 CVE-2019-16309 · GHSA-q8gr-c7m5-r9p3

MEDIUM 50

FlameCMS 3.3.5 has SQL injection in account/login.php via accountName.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.05026 Published 2019-09-14 No fix listed CWE-89