Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

4 records

Vendor: Jan Syski Component: Megabip Clear all filters
TI-2024-01542 CVE-2024-1659 · GHSA-cmgh-j7wm-g8fg

Arbitrary File Upload in MegaBIP

Priority MEDIUM 49

Arbitrary File Upload vulnerability in MegaBIP software allows attacker to upload any file to the server (including a PHP code file) without an authentication.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00689 Published 2024-06-12 No fix listed CWE-434
TI-2024-01473 CVE-2024-1577 · GHSA-6577-hj74-984x

Remote Code Execution in MegaBIP

Priority MEDIUM 50

Remote Code Execution vulnerability in MegaBIP software allows to execute arbitrary code on the server without requiring authentication by saving crafted by the attacker PHP code to one of the website files.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.01126 Published 2024-06-12 No fix listed CWE-94
TI-2024-01472 CVE-2024-1576 · GHSA-27fw-99r5-fg9c

SQL Injection in MegaBIP

Priority MEDIUM 49

SQL Injection vulnerability in MegaBIP software allows attacker to obtain site administrator privileges, including access to the administration panel and the ability to change the administrator password.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00571 Published 2024-06-12 No fix listed CWE-89
TI-2023-04949 CVE-2023-5378 · GHSA-9w3h-593p-q56r

Stored XSS in SmodBIP and MegaBIP

Priority MEDIUM 41

Improper Input Validation vulnerability in MegaBIP and already unsupported SmodBIP software allows for Stored XSS.This issue affects SmodBIP in all versions and MegaBIP in versions up to 4.36.2.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00527 Published 2024-01-29 Fixed in 5.08 CWE-79