Priority MEDIUM 50
SQL Injection vulnerability in Gambio through 4.9.2.0 allows attackers to run arbitrary SQL commands via crafted GET request using modifiers[attribute][] parameter.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00629 · Published 2024-02-12 · No fix listed CWE-89
Priority LOW 36
Unrestricted File Upload vulnerability in Content Manager feature in Gambio 4.9.2.0 allows attackers to execute arbitrary code via upload of crafted PHP file.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00322 · Published 2024-02-12 · No fix listed CWE-434
Priority HIGH 82
Server Side Template Injection in Gambio 4.9.2.0 allows attackers to run arbitrary code via crafted smarty email template.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00659 · Published 2024-02-12 · No fix listed CWE-918
Priority LOW 14
Cleartext Storage of Sensitive Information in Gambio 4.9.2.0 allows attackers to obtain sensitive information via error-handler.log.json and legacy-error-handler.log.txt under the webroot.
CVSS 3.1LOW 2.7· Network · High privileges · No interaction · EPSS 0.00442 · Published 2024-02-12 · No fix listed CWE-532
Priority HIGH 73
Deserialization of Untrusted Data in Gambio through 4.9.2.0 allows attackers to run arbitrary code via "search" parameter of the Parcelshopfinder/AddAddressBookEntry" function.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.47549 · Published 2024-02-12 · No fix listed CWE-502
Priority LOW 25
Gambio GX before 4.0.1.0 allows SQL Injection in admin/gv_mail.php.
CVSS 3.1MEDIUM 4.9· Network · High privileges · No interaction · EPSS 0.01371 · Published 2020-07-28 · No fix listed CWE-89
Priority LOW 25
Gambio GX before 4.0.1.0 allows SQL Injection in admin/mobile.php.
CVSS 3.1MEDIUM 4.9· Network · High privileges · No interaction · EPSS 0.014 · Published 2020-07-28 · No fix listed CWE-89
Priority LOW 39
Gambio GX before 4.0.1.0 allows admin/admin.php CSRF.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00715 · Published 2020-07-28 · No fix listed CWE-352
Priority LOW 23
Gambio GX before 4.0.1.0 allows XSS in admin/coupon_admin.php.
CVSS 3.1MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.00598 · Published 2020-07-28 · No fix listed CWE-79
Priority LOW 35
SQL injection vulnerability in product_reviews_info.php in xt:Commerce Gambio 2008 allows remote attackers to execute arbitrary SQL commands via the products_id parameter.
CVSS 2.0HIGH 7.5· Network · No auth · Interaction — · EPSS 0.00986 · Published 2011-10-09 · No fix listed CWE-89
THREATIST.IORead the docs