Priority LOW 27
routers/ajaxRouter.php in doorGets 7.0 has a web site physical path leakage vulnerability, as demonstrated by an ajax/index.php?uri=1234%5c request.
CVSS 3.0MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.01264 · Published 2019-04-30 · No fix listed CWE-21
Priority LOW 25
doorGets 7.0 has a SQL injection vulnerability in /doorgets/app/requests/user/emailingRequest.php.
CVSS 3.0MEDIUM 4.9· Network · High privileges · No interaction · EPSS 0.01199 · Published 2019-04-30 · No fix listed CWE-89
Priority LOW 26
doorGets 7.0 has an arbitrary file deletion vulnerability in /doorgets/app/requests/user/configurationRequest.php.
CVSS 3.0MEDIUM 4.9· Network · High privileges · No interaction · EPSS 0.01566 · Published 2019-04-30 · No fix listed CWE-22
Priority LOW 25
doorGets 7.0 has a SQL injection vulnerability in /doorgets/app/requests/user/configurationRequest.php when action=siteweb.
CVSS 3.0MEDIUM 4.9· Network · High privileges · No interaction · EPSS 0.01199 · Published 2019-04-30 · No fix listed CWE-89
Priority LOW 25
doorGets 7.0 has a SQL injection vulnerability in /doorgets/app/requests/user/modulecategoryRequest.php.
CVSS 3.0MEDIUM 4.9· Network · High privileges · No interaction · EPSS 0.01199 · Published 2019-04-30 · No fix listed CWE-89
Priority LOW 25
doorGets 7.0 has a SQL injection vulnerability in /doorgets/app/requests/user/configurationRequest.php when action=network.
CVSS 3.0MEDIUM 4.9· Network · High privileges · No interaction · EPSS 0.01199 · Published 2019-04-30 · No fix listed CWE-89
Priority LOW 25
doorGets 7.0 has a SQL injection vulnerability in /doorgets/app/requests/user/modulecategoryRequest.php.
CVSS 3.0MEDIUM 4.9· Network · High privileges · No interaction · EPSS 0.01199 · Published 2019-04-30 · No fix listed CWE-89
Priority LOW 25
doorGets 7.0 has a SQL injection vulnerability in /doorgets/app/requests/user/configurationRequest.php when action=analytics.
CVSS 3.0MEDIUM 4.9· Network · High privileges · No interaction · EPSS 0.01199 · Published 2019-04-30 · No fix listed CWE-89
Priority MEDIUM 46
doorGets 7.0 has a default administrator credential vulnerability.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02283 · Published 2019-04-30 · No fix listed CWE-1188
Priority MEDIUM 40
doorGets 7.0 has a CSRF vulnerability in /doorgets/app/requests/user/configurationRequest.php.
CVSS 3.0HIGH 8.8· Network · No auth · User interaction · EPSS 0.00823 · Published 2019-04-30 · No fix listed CWE-352
Priority MEDIUM 47
doorGets 7.0 has a sensitive information disclosure vulnerability in /setup/temp/admin.php and /setup/temp/database.php.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02435 · Published 2019-04-30 · No fix listed
Priority MEDIUM 41
/fileman/php/upload.php in doorGets 7.0 has an arbitrary file upload vulnerability.
CVSS 3.0HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01493 · Published 2019-04-30 · No fix listed CWE-434
Priority LOW 36
doorGets 7.0 has a SQL injection vulnerability in /doorgets/app/views/ajax/commentView.php.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.01518 · Published 2019-04-30 · No fix listed CWE-89
Priority LOW 31
doorGets 7.0 has a SQL injection vulnerability in /doorgets/app/views/ajax/contactView.php.
CVSS 3.0MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.01161 · Published 2019-04-30 · No fix listed CWE-89
Priority LOW 38
doorGets 7.0 has an arbitrary file deletion vulnerability in /fileman/php/deletefile.php.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.02699 · Published 2019-04-30 · No fix listed CWE-22
Priority LOW 39
doorGets 7.0 has a sensitive information disclosure vulnerability in /fileman/php/download.php.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.03869 · Published 2019-04-30 · No fix listed CWE-22
Priority LOW 39
doorGets 7.0 has a sensitive information disclosure vulnerability in /fileman/php/downloaddir.php.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.03869 · Published 2019-04-30 · No fix listed CWE-22
Priority MEDIUM 42
doorGets 7.0 has a sensitive information disclosure vulnerability in /fileman/php/movefile.php.
CVSS 3.0HIGH 8.2· Network · No auth · No interaction · EPSS 0.04018 · Published 2019-04-30 · No fix listed CWE-22
Priority MEDIUM 43
doorGets 7.0 has a sensitive information disclosure vulnerability in /fileman/php/renamefile.php.
CVSS 3.0HIGH 8.2· Network · No auth · No interaction · EPSS 0.04129 · Published 2019-04-30 · No fix listed CWE-22
Priority LOW 39
doorGets 7.0 has a sensitive information disclosure vulnerability in /fileman/php/copydir.php.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.03869 · Published 2019-04-30 · No fix listed CWE-22
Priority LOW 39
doorGets 7.0 has a sensitive information disclosure vulnerability in /fileman/php/copyfile.php.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.03869 · Published 2019-04-30 · No fix listed CWE-22
Priority LOW 38
doorGets 7.0 allows remote attackers to write to arbitrary files via directory traversal, as demonstrated by a dg-user/?controller=theme&action=edit&name=doorgets&file=../../1.txt%00 URI with content in the theme_content…
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.02655 · Published 2018-12-11 · No fix listed CWE-22
Priority LOW 39
dg-user/?controller=users&action=add in doorGets 7.0 has CSRF that results in adding an administrator account.
CVSS 3.0HIGH 8.8· Network · No auth · User interaction · EPSS 0.00628 · Published 2018-05-15 · No fix listed CWE-352
Priority LOW 33
SQL injection vulnerability in dg-admin/index.php in doorGets CMS 5.2 and earlier allows remote authenticated administrators to execute arbitrary SQL commands via the _position_down_id parameter.
CVSS 2.0MEDIUM 6.5· Network · Low privileges · Interaction — · EPSS 0.02269 · Published 2014-02-11 · No fix listed CWE-89
THREATIST.IORead the docs