Vulnerabilities

TI-2026-49178 CVE-2026-70375 · GHSA-h9gr-58w4-64cq

HashBrown CMS - OS Command Injection via Git Deployer Branch Field

MEDIUM 44

HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in the Git deployer component.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01868 Published 2026-08-05 No fix listed CWE-78

TI-2026-49177 CVE-2026-70374 · GHSA-f8rj-8x92-pfp5

MEDIUM 44

HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in the media upload thumbnail generation routine.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01868 Published 2026-08-05 No fix listed CWE-78

TI-2020-05600 CVE-2020-6948 · GHSA-4gjv-5jjp-rcgh

MEDIUM 47

A remote code execution issue was discovered in HashBrown CMS through 1.3.3.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02799 Published 2020-01-13 Fixed in 1.3.4 CWE-78

TI-2020-05601 CVE-2020-6949 · GHSA-6j5x-7wrv-w5qh

MEDIUM 41

A privilege escalation issue was discovered in the postUser function in HashBrown CMS through 1.3.3.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01281 Published 2020-01-13 No fix listed CWE-269

TI-2020-04761 CVE-2020-5840 · GHSA-q7hx-mrv5-6mrp

LOW 36

An issue was discovered in HashBrown CMS before 1.3.2.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01494 Published 2020-01-06 Fixed in 1.3.2 CWE-22