Vulnerabilities

TI-2024-06581 CVE-2024-7106 · GHSA-wqw3-p83g-r24v

Spina CMS media_folders cross-site request forgery

MEDIUM 64

A vulnerability classified as problematic was found in Spina CMS 2.18.0.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00431 Published 2024-07-25 No fix listed CWE-352

TI-2024-06547 CVE-2024-7065 · GHSA-x5wj-v66v-v62h

MEDIUM 64

A vulnerability was found in Spina CMS up to 2.18.0.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00356 Published 2024-07-24 No fix listed CWE-352

TI-2024-27691 CVE-2024-41603 · GHSA-87xw-f5qh-7hwg

MEDIUM 42

Spina CMS v2.18.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the URI /admin/layout.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.00214 Published 2024-07-19 No fix listed CWE-352

TI-2024-27690 CVE-2024-41602 · GHSA-m32m-7r76-7jh4

MEDIUM 40

Cross Site Request Forgery vulnerability in Spina CMS v.2.18.0 and before allows a remote attacker to escalate privileges via a crafted URL

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00256 Published 2024-07-19 No fix listed CWE-352

TI-2023-03219 CVE-2023-3445 · GHSA-97wh-6hmj-g8j9

MEDIUM 55

Cross-site Scripting (XSS) - Stored in GitHub repository spinacms/spina prior to 2.15.1.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00565 Published 2023-06-28 Fixed in 2.15.1 CWE-79

TI-2015-03866 CVE-2015-4619 · GHSA-2hxv-mx8x-mcj9

MEDIUM 40

Cross-site request forgery (CSRF) vulnerability in Spina before commit bfe44f289e336f80b6593032679300c493735e75.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.00903 Published 2017-09-07 Fixed in 0.6.29 CWE-352