Vulnerabilities

TI-2022-23340 CVE-2022-47135 · GHSA-29f5-5fq5-r4fr

WordPress Chronoforms Plugin <= 7.0.9 is vulnerable to Cross Site Request Forgery (CSRF)

LOW 38

Cross-Site Request Forgery (CSRF) vulnerability in chronoengine.Com Chronoforms plugin <= 7.0.9 versions.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.0026 Published 2023-05-25 No fix listed CWE-352

TI-2021-09530 CVE-2021-28376 · GHSA-g664-8xwh-mv2c

ChronoForms 7.0.7 allows fname Directory Traversal to read arbitrary files.

LOW 16

ChronoForms 7.0.7 allows fname Directory Traversal to read arbitrary files.

CVSS 3.1LOW 2.7 Network High privileges No interaction EPSS 0.01119 Published 2022-01-12 No fix listed CWE-22

TI-2021-09531 CVE-2021-28377 · GHSA-8p5v-jw4g-v47q

ChronoForums 2.0.11 allows av Directory Traversal to read arbitrary files.

LOW 35

ChronoForums 2.0.11 allows av Directory Traversal to read arbitrary files.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.0852 Published 2022-01-12 No fix listed CWE-22

TI-2020-16669 CVE-2020-27459 · GHSA-whhf-44jp-82gr

Chronoforeum 2.0.11 allows Stored XSS vulnerabilities when inserting a crafted payload…

LOW 29

Chronoforeum 2.0.11 allows Stored XSS vulnerabilities when inserting a crafted payload into a post.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00945 Published 2020-11-16 No fix listed CWE-79

TI-2008-00539 CVE-2008-0567 · GHSA-85pc-mc7f-26qw

Multiple PHP remote file inclusion vulnerabilities in ChronoEngine ChronoForms…

MEDIUM 58

Multiple PHP remote file inclusion vulnerabilities in ChronoEngine ChronoForms (com_chronocontact) 2.3.5 component for Joomla! allow remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.34307 Published 2008-02-05 No fix listed CWE-94

Vulnerabilities

Filters

WordPress Chronoforms Plugin <= 7.0.9 is vulnerable to Cross Site Request Forgery (CSRF)

ChronoForms 7.0.7 allows fname Directory Traversal to read arbitrary files.

ChronoForums 2.0.11 allows av Directory Traversal to read arbitrary files.

Chronoforeum 2.0.11 allows Stored XSS vulnerabilities when inserting a crafted payload…

Multiple PHP remote file inclusion vulnerabilities in ChronoEngine ChronoForms…