Vulnerabilities

TI-2014-01819 CVE-2014-2293 · GHSA-vqj5-q9w2-v83r

Zikula Application Framework before 1.3.7 build 11 allows remote attackers to conduct PHP…

MEDIUM 50

Zikula Application Framework before 1.3.7 build 11 allows remote attackers to conduct PHP object injection attacks and delete arbitrary files or execute arbitrary PHP code via crafted serialized data in the (1) authentic…

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.04674 Published 2018-03-26 No fix listed CWE-94

TI-2016-07964 CVE-2016-9835 · GHSA-2xj4-744c-pqqp

Directory traversal vulnerability in file "jcss.php" in Zikula 1.3.x before 1.3.11 and…

MEDIUM 49

Directory traversal vulnerability in file "jcss.php" in Zikula 1.3.x before 1.3.11 and 1.4.x before 1.4.4 on Windows allows a remote attacker to launch a PHP object injection by uploading a serialized file.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.03918 Published 2016-12-05 No fix listed CWE-284

TI-2013-05189 CVE-2013-6168 · GHSA-c96c-rh6h-9j4g

Cross-site scripting (XSS) vulnerability in Zikula Application Framework before 1.3.6…

LOW 23

Cross-site scripting (XSS) vulnerability in Zikula Application Framework before 1.3.6 allows remote attackers to inject arbitrary web script or HTML via the returnpage parameter to index.php.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.0122 Published 2013-11-14 No fix listed CWE-79

TI-2011-03519 CVE-2011-3979 · GHSA-c3cc-gm9v-rc3h

Cross-site scripting (XSS) vulnerability in…

LOW 27

Cross-site scripting (XSS) vulnerability in ztemp/view_compiled/Theme/theme_admin_setasdefault.php in the theme module in Zikula Application Framework 1.3.0 build 3168, 1.2.7, and probably other versions allows remote at…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.04158 Published 2011-10-04 No fix listed CWE-79

TI-2011-00805 CVE-2011-0911 · GHSA-rx38-v4jx-9vw9

Cross-site scripting (XSS) vulnerability in the Users module in Zikula before 1.2.5…

LOW 22

Cross-site scripting (XSS) vulnerability in the Users module in Zikula before 1.2.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.00855 Published 2011-02-08 No fix listed CWE-79

TI-2011-00462 CVE-2011-0535 · GHSA-4x2p-6cr9-jx6r

Cross-site request forgery (CSRF) vulnerability in the Users module in Zikula before…

LOW 33

Cross-site request forgery (CSRF) vulnerability in the Users module in Zikula before 1.2.5 allows remote attackers to hijack the authentication of administrators for requests that change account privileges via an edit ac…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.01434 Published 2011-02-08 No fix listed CWE-352

TI-2010-04452 CVE-2010-4729 · GHSA-j4jq-jwjr-wj8f

Zikula before 1.2.3 does not use the authid protection mechanism for (1) the lostpassword…

LOW 31

Zikula before 1.2.3 does not use the authid protection mechanism for (1) the lostpassword form and (2) mailpasswd processing, which makes it easier for remote attackers to generate a flood of password requests and possib…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.00524 Published 2011-02-08 No fix listed CWE-352

TI-2010-04451 CVE-2010-4728 · GHSA-wf9j-wrqc-3h9g

Zikula before 1.3.1 uses the rand and srand PHP functions for random number generation…

LOW 25

Zikula before 1.3.1 uses the rand and srand PHP functions for random number generation, which makes it easier for remote attackers to defeat protection mechanisms based on randomization by predicting a return value, as d…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.00949 Published 2011-02-08 No fix listed CWE-310

TI-2010-01661 CVE-2010-1732 · GHSA-4fwm-c2h6-5mpp

Cross-site request forgery (CSRF) vulnerability in the users module in Zikula Application…

LOW 31

Cross-site request forgery (CSRF) vulnerability in the users module in Zikula Application Framework before 1.2.3 allows remote attackers to hijack the authentication of administrators for requests that change the adminis…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.00524 Published 2010-05-05 No fix listed CWE-352

TI-2010-01653 CVE-2010-1724 · GHSA-v4jw-6942-wg6v

Multiple cross-site scripting (XSS) vulnerabilities in Zikula Application Framework…

LOW 27

Multiple cross-site scripting (XSS) vulnerabilities in Zikula Application Framework 1.2.2, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via the (1) func parameter to index.php, or t…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.04103 Published 2010-05-05 No fix listed CWE-79

Vulnerabilities

Filters