Vulnerabilities

TI-2024-07096 CVE-2024-7657 · GHSA-mvc8-3q87-prg9

Gila CMS HTTP POST Request page cross site scripting

MEDIUM 57

A vulnerability classified as problematic was found in Gila CMS 1.10.9.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00589 Published 2024-08-11 No fix listed CWE-79

TI-2020-16225 CVE-2020-26625 · GHSA-3pfj-g4wr-qj3j

A SQL injection vulnerability was discovered in Gila CMS 1.15.4 and earlier which allows…

MEDIUM 51

A SQL injection vulnerability was discovered in Gila CMS 1.15.4 and earlier which allows a remote attacker to execute arbitrary web scripts via the 'user_id' parameter after the login portal.

CVSS 3.1LOW 3.8 Network High privileges No interaction EPSS 0.00668 Published 2024-01-02 No fix listed CWE-89

TI-2020-16224 CVE-2020-26624 · GHSA-4vf6-2rmx-fgqx

A SQL injection vulnerability was discovered in Gila CMS 1.15.4 and earlier which allows…

LOW 27

A SQL injection vulnerability was discovered in Gila CMS 1.15.4 and earlier which allows a remote attacker to execute arbitrary web scripts via the ID parameter after the login portal.

CVSS 3.1LOW 3.8 Network High privileges No interaction EPSS 0.00668 Published 2024-01-02 No fix listed CWE-89

TI-2020-16223 CVE-2020-26623 · GHSA-rpjw-97p8-p2xp

SQL Injection vulnerability discovered in Gila CMS 1.15.4 and earlier allows a remote…

MEDIUM 51

SQL Injection vulnerability discovered in Gila CMS 1.15.4 and earlier allows a remote attacker to execute arbitrary web scripts via the Area parameter under the Administration>Widget tab after the login portal.

CVSS 3.1LOW 3.8 Network High privileges No interaction EPSS 0.00668 Published 2024-01-02 No fix listed CWE-89

TI-2020-13872 CVE-2020-20523 · GHSA-rvjp-j5j4-c9j5

Cross Site Scripting (XSS) vulnerability in adm_user parameter in Gila CMS version…

MEDIUM 60

Cross Site Scripting (XSS) vulnerability in adm_user parameter in Gila CMS version 1.11.3, allows remote attackers to execute arbitrary code during the Gila CMS installation.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00682 Published 2023-08-11 Fixed in 1.11.4 CWE-79

TI-2020-13921 CVE-2020-20726 · GHSA-4cw3-rhqx-vqwr

Cross Site Request Forgery vulnerability in Gila GilaCMS v.1.11.4 allows a remote…

HIGH 73

Cross Site Request Forgery vulnerability in Gila GilaCMS v.1.11.4 allows a remote attacker to execute arbitrary code via the cm/update_rows/user parameter.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00665 Published 2023-06-20 No fix listed CWE-352

TI-2021-16772 CVE-2021-39486 · GHSA-pwr4-6gwm-r5cc

A Stored XSS via Malicious File Upload exists in Gila CMS version 2.2.0.

LOW 25

A Stored XSS via Malicious File Upload exists in Gila CMS version 2.2.0.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00569 Published 2021-10-04 No fix listed CWE-79

TI-2021-15630 CVE-2021-37777 · GHSA-m6vx-x725-7c66

Gila CMS 2.2.0 is vulnerable to Insecure Direct Object Reference (IDOR).

LOW 36

Gila CMS 2.2.0 is vulnerable to Insecure Direct Object Reference (IDOR).

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01702 Published 2021-10-04 No fix listed CWE-639

TI-2020-13910 CVE-2020-20693 · GHSA-hwqc-pgjw-vjqp

A Cross-Site Request Forgery (CSRF) in GilaCMS v1.11.4 allows authenticated attackers to…

LOW 39

A Cross-Site Request Forgery (CSRF) in GilaCMS v1.11.4 allows authenticated attackers to arbitrarily add administrator accounts.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.007 Published 2021-09-27 No fix listed CWE-352

TI-2020-13912 CVE-2020-20696 · GHSA-h7mq-27r7-w972

A cross-site scripting (XSS) vulnerability in /admin/content/post of GilaCMS v1.11.4…

LOW 25

A cross-site scripting (XSS) vulnerability in /admin/content/post of GilaCMS v1.11.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the Tags field.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00493 Published 2021-09-27 No fix listed CWE-79

TI-2020-13911 CVE-2020-20695 · GHSA-6675-wwqr-jhmf

A stored cross-site scripting (XSS) vulnerability in GilaCMS v1.11.4 allows attackers to…

LOW 25

A stored cross-site scripting (XSS) vulnerability in GilaCMS v1.11.4 allows attackers to execute arbitrary web scripts or HTML via a crafted SVG file.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00516 Published 2021-09-27 No fix listed CWE-79

TI-2020-13909 CVE-2020-20692 · GHSA-c7gp-j3ff-rvrf

GilaCMS v1.11.4 was discovered to contain a SQL injection vulnerability via the $_GET…

LOW 34

GilaCMS v1.11.4 was discovered to contain a SQL injection vulnerability via the $_GET parameter in /src/core/controllers/cm.php.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.0126 Published 2021-09-27 No fix listed CWE-89

TI-2020-17386 CVE-2020-28692 · GHSA-xhcm-8344-w8gw

In Gila CMS 1.16.0, an attacker can upload a shell to tmp directy and abuse .htaccess…

LOW 35

In Gila CMS 1.16.0, an attacker can upload a shell to tmp directy and abuse .htaccess through the logs function for executing PHP files.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01639 Published 2020-11-16 No fix listed CWE-434

TI-2019-15021 CVE-2019-20803 · GHSA-fgjq-fq6w-4j3h

Gila CMS before 1.11.6 has reflected XSS via the admin/content/postcategory id parameter…

LOW 31

Gila CMS before 1.11.6 has reflected XSS via the admin/content/postcategory id parameter, which is mishandled for g_preview_theme.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0186 Published 2020-05-21 No fix listed CWE-79

TI-2019-15022 CVE-2019-20804 · GHSA-6mpc-7q32-wg3c

Gila CMS before 1.11.6 allows CSRF with resultant XSS via the admin/themes URI, leading…

MEDIUM 40

Gila CMS before 1.11.6 allows CSRF with resultant XSS via the admin/themes URI, leading to compromise of the admin account.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01108 Published 2020-05-21 No fix listed CWE-352

TI-2020-04484 CVE-2020-5512 · GHSA-9qf5-wrp4-x43x

Gila CMS 1.11.8 allows /admin/media?path=../ Path Traversal.

MEDIUM 48

Gila CMS 1.11.8 allows /admin/media?path=../ Path Traversal.

CVSS 3.1MEDIUM 6.8 Network High privileges No interaction EPSS 0.18894 Published 2020-01-06 No fix listed CWE-22

TI-2020-04485 CVE-2020-5513 · GHSA-777v-j39v-h8x4

Gila CMS 1.11.8 allows /cm/delete?t=../ Directory Traversal.

MEDIUM 52

Gila CMS 1.11.8 allows /cm/delete?t=../ Directory Traversal.

CVSS 3.1MEDIUM 6.8 Network High privileges No interaction EPSS 0.25792 Published 2020-01-06 No fix listed CWE-22

TI-2020-04486 CVE-2020-5514 · GHSA-6m73-xcgm-75f2

Gila CMS 1.11.8 allows Unrestricted Upload of a File with a Dangerous Type via .phar or…

HIGH 68

Gila CMS 1.11.8 allows Unrestricted Upload of a File with a Dangerous Type via .phar or .phtml to the lzld/thumb?src= URI.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.44107 Published 2020-01-06 No fix listed CWE-434

TI-2020-04487 CVE-2020-5515 · GHSA-322g-3p44-gp9p

Gila CMS 1.11.8 allows /admin/sql?query= SQL Injection.

MEDIUM 54

Gila CMS 1.11.8 allows /admin/sql?query= SQL Injection.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.26546 Published 2020-01-06 No fix listed CWE-89

TI-2019-13080 CVE-2019-17536 · GHSA-43m6-mm77-vrc8

Gila CMS through 1.11.4 allows Unrestricted Upload of a File with a Dangerous Type via…

LOW 27

Gila CMS through 1.11.4 allows Unrestricted Upload of a File with a Dangerous Type via the moveAction function in core/controllers/fm.php.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.02254 Published 2019-10-13 No fix listed CWE-434

TI-2019-13079 CVE-2019-17535 · GHSA-2f6c-r6m4-6362

Gila CMS through 1.11.4 allows blog-list.php XSS, in both the gila-blog and gila-mag…

LOW 31

Gila CMS through 1.11.4 allows blog-list.php XSS, in both the gila-blog and gila-mag themes, via the search parameter, a related issue to CVE-2019-9647.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.02013 Published 2019-10-13 No fix listed CWE-79

TI-2019-12475 CVE-2019-16679 · GHSA-q8qv-mx55-vx4r

Gila CMS before 1.11.1 allows admin/fm/?f=../ directory traversal, leading to Local File Inclusion.

LOW 32

Gila CMS before 1.11.1 allows admin/fm/?f=../ directory traversal, leading to Local File Inclusion.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.07032 Published 2019-09-21 No fix listed CWE-22

TI-2019-07060 CVE-2019-9647 · GHSA-85wg-37r3-q9fv

Gila CMS 1.9.1 has XSS.

LOW 32

Gila CMS 1.9.1 has XSS.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.02261 Published 2019-06-05 No fix listed CWE-79

TI-2019-08605 CVE-2019-11515 · GHSA-5fpm-2hr9-rpp9

core/classes/db_backup.php in Gila CMS 1.10.1 allows admin/db_backup?download= absolute…

LOW 26

core/classes/db_backup.php in Gila CMS 1.10.1 allows admin/db_backup?download= absolute path traversal to read arbitrary files.

CVSS 3.0MEDIUM 4.9 Network High privileges No interaction EPSS 0.02021 Published 2019-04-25 No fix listed CWE-22

TI-2019-08551 CVE-2019-11456 · GHSA-q75v-4pgj-fr8q

Gila CMS 1.10.1 allows fm/save CSRF for executing arbitrary PHP code.

MEDIUM 40

Gila CMS 1.10.1 allows fm/save CSRF for executing arbitrary PHP code.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.00887 Published 2019-04-22 No fix listed CWE-352

Vulnerabilities

Filters