Vulnerabilities

TI-2021-20875 CVE-2021-45843 · GHSA-vrpw-6q4x-xxxj

glFusion CMS v1.7.9 is affected by a reflected Cross Site Scripting (XSS) vulnerability.

LOW 28

glFusion CMS v1.7.9 is affected by a reflected Cross Site Scripting (XSS) vulnerability.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00679 Published 2021-12-27 No fix listed CWE-79

TI-2021-20342 CVE-2021-44942 · GHSA-6xx3-7c4w-v79g

glFusion CMS 1.7.9 is affected by a Cross Site Request Forgery (CSRF) vulnerability in…

LOW 20

glFusion CMS 1.7.9 is affected by a Cross Site Request Forgery (CSRF) vulnerability in /public_html/admin/plugins/bad_behavior2/blacklist.php.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00361 Published 2021-12-14 No fix listed CWE-352

TI-2021-20343 CVE-2021-44949 · GHSA-9gpq-82h8-hgx9

glFusion CMS 1.7.9 is affected by an access control vulnerability via /public_html/users.php.

MEDIUM 44

glFusion CMS 1.7.9 is affected by an access control vulnerability via /public_html/users.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01164 Published 2021-12-14 No fix listed CWE-639

TI-2021-20341 CVE-2021-44937 · GHSA-jcfc-rpmc-pcm7

glFusion CMS v1.7.9 is affected by an arbitrary user registration vulnerability in…

LOW 25

glFusion CMS v1.7.9 is affected by an arbitrary user registration vulnerability in /public_html/users.php.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00733 Published 2021-12-14 No fix listed CWE-287

TI-2021-20340 CVE-2021-44935 · GHSA-h98c-r5q9-prxg

glFusion CMS v1.7.9 is affected by an arbitrary user impersonation vulnerability in…

MEDIUM 40

glFusion CMS v1.7.9 is affected by an arbitrary user impersonation vulnerability in /public_html/comment.php.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00533 Published 2021-12-14 No fix listed CWE-346

TI-2013-01274 CVE-2013-1466 · GHSA-2cp8-rpw3-7698

Multiple cross-site scripting (XSS) vulnerabilities in glFusion before 1.2.2.pl4 allow…

LOW 27

Multiple cross-site scripting (XSS) vulnerabilities in glFusion before 1.2.2.pl4 allow remote attackers to inject arbitrary web script or HTML via the (1) subject parameter to profiles.php; (2) address1, (3) address2, (4…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.03775 Published 2014-02-05 No fix listed CWE-79

TI-2009-04552 CVE-2009-4796 · GHSA-m85p-59cq-jm25

Multiple SQL injection vulnerabilities in the ExecuteQueries function in…

LOW 37

Multiple SQL injection vulnerabilities in the ExecuteQueries function in private/system/classes/listfactory.class.php in glFusion 1.1.2 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) ord…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.02337 Published 2010-04-22 No fix listed CWE-89

TI-2009-01218 CVE-2009-1283 · GHSA-q493-5m3q-745m

glFusion before 1.1.3 performs authentication with a user-provided password hash instead…

LOW 33

glFusion before 1.1.3 performs authentication with a user-provided password hash instead of a password, which allows remote attackers to gain privileges by obtaining the hash and using it in the glf_password cookie, aka…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.01258 Published 2009-04-09 No fix listed CWE-310

TI-2009-01217 CVE-2009-1282 · GHSA-h29h-q852-5fjw

SQL injection vulnerability in private/system/lib-session.php in glFusion 1.1.2 and…

LOW 38

SQL injection vulnerability in private/system/lib-session.php in glFusion 1.1.2 and earlier allows remote attackers to execute arbitrary SQL commands via the glf_session cookie parameter.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.0272 Published 2009-04-09 No fix listed CWE-89

TI-2009-01216 CVE-2009-1281 · GHSA-7q6f-mfrg-j6x7

Cross-site scripting (XSS) vulnerability in glFusion before 1.1.3 allows remote attackers…

LOW 23

Cross-site scripting (XSS) vulnerability in glFusion before 1.1.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01493 Published 2009-04-09 No fix listed CWE-79

TI-2009-00435 CVE-2009-0455 · GHSA-vx7j-5c4x-j878

Cross-site scripting (XSS) vulnerability in the anonymous comments feature in…

LOW 16

Cross-site scripting (XSS) vulnerability in the anonymous comments feature in lib-comment.php in glFusion 1.1.0, 1.1.1, and earlier versions allows remote attackers to inject arbitrary web script or HTML via the username…

CVSS 2.0LOW 2.6 Network No auth Interaction — EPSS 0.01615 Published 2009-02-11 No fix listed CWE-79

Vulnerabilities

Filters