Vulnerabilities

TI-2025-35398 CVE-2025-56704 · GHSA-pvcf-257h-r9p4

LeptonCMS version 7.3.0 contains an arbitrary file upload vulnerability, which is caused…

HIGH 73

LeptonCMS version 7.3.0 contains an arbitrary file upload vulnerability, which is caused by the lack of proper validation for uploaded files.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00766 Published 2025-12-09 No fix listed CWE-434

TI-2024-19481 CVE-2024-29514 · GHSA-3m9j-v59x-pvvm

File Upload vulnerability in lepton v.7.1.0 allows a remote authenticated attackers to…

HIGH 73

File Upload vulnerability in lepton v.7.1.0 allows a remote authenticated attackers to execute arbitrary code via uploading a crafted PHP file.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01281 Published 2024-04-02 No fix listed CWE-434

TI-2024-19482 CVE-2024-29515 · GHSA-w4xx-6m5j-27fx

File Upload vulnerability in lepton v.7.1.0 allows a remote authenticated attackers to…

HIGH 73

File Upload vulnerability in lepton v.7.1.0 allows a remote authenticated attackers to execute arbitrary code via uploading a crafted PHP file to the save.php and config.php component.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01164 Published 2024-03-25 No fix listed CWE-434

TI-2024-16165 CVE-2024-24520 · GHSA-x4jx-mwq9-xjr3

An issue in Lepton CMS v.7.0.0 allows a local attacker to execute arbitrary code via the…

HIGH 69

An issue in Lepton CMS v.7.0.0 allows a local attacker to execute arbitrary code via the upgrade.php file in the languages place.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00421 Published 2024-02-29 No fix listed CWE-94

TI-2024-16106 CVE-2024-24399 · GHSA-6m93-gmrj-jf29

An arbitrary file upload vulnerability in LEPTON v7.0.0 allows authenticated attackers to…

HIGH 67

An arbitrary file upload vulnerability in LEPTON v7.0.0 allows authenticated attackers to execute arbitrary PHP code by uploading this code to the backend/languages/index.php languages area.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.15597 Published 2024-01-25 No fix listed CWE-434

TI-2020-15222 CVE-2020-24872 · GHSA-5f9f-p6gc-2j35

Cross Site Scripting (XSS) vulnerability in backend/pages/modify.php in Lepton-CMS…

LOW 28

Cross Site Scripting (XSS) vulnerability in backend/pages/modify.php in Lepton-CMS version 4.7.0, allows remote attackers to execute arbitrary code.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00509 Published 2023-08-11 No fix listed CWE-79

TI-2020-17610 CVE-2020-29240 · GHSA-gx4g-83m8-7hhx

Lepton-CMS 4.7.0 is affected by cross-site scripting (XSS).

LOW 25

Lepton-CMS 4.7.0 is affected by cross-site scripting (XSS).

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.01693 Published 2020-12-02 No fix listed CWE-79

TI-2020-10103 CVE-2020-12705 · GHSA-w426-v599-whp2

Multiple cross-site scripting (XSS) vulnerabilities exist in LeptonCMS before 4.6.0.

LOW 28

Multiple cross-site scripting (XSS) vulnerabilities exist in LeptonCMS before 4.6.0.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00641 Published 2020-05-07 No fix listed CWE-79

TI-2020-10105 CVE-2020-12707 · GHSA-x28g-jx38-xw6g

An XSS vulnerability exists in modules/wysiwyg/save.php of LeptonCMS 4.5.0.

LOW 30

An XSS vulnerability exists in modules/wysiwyg/save.php of LeptonCMS 4.5.0.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01225 Published 2020-05-07 No fix listed CWE-79

TI-2012-00914 CVE-2012-1000 · GHSA-rc5q-45r8-3q3c

Multiple cross-site scripting (XSS) vulnerabilities in LEPTON 1.1.3 and other versions…

LOW 22

Multiple cross-site scripting (XSS) vulnerabilities in LEPTON 1.1.3 and other versions before 1.1.4 allow remote attackers to inject arbitrary web script or HTML via the (1) message parameter to admins/login/forgot/index…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01095 Published 2012-02-20 No fix listed CWE-79

TI-2012-00913 CVE-2012-0999 · GHSA-797x-6m3w-gjc3

SQL injection vulnerability in modules/news/rss.php in LEPTON before 1.1.4 allows remote…

LOW 35

SQL injection vulnerability in modules/news/rss.php in LEPTON before 1.1.4 allows remote attackers to execute arbitrary SQL commands via the group_id parameter.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.01188 Published 2012-02-20 No fix listed CWE-89

TI-2012-00912 CVE-2012-0998 · GHSA-grhx-7jf3-m39p

Directory traversal vulnerability in account/preferences.php in LEPTON before 1.1.4…

LOW 36

Directory traversal vulnerability in account/preferences.php in LEPTON before 1.1.4 allows remote attackers to include and execute arbitrary files via a ..

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.01641 Published 2012-02-20 No fix listed CWE-22

TI-2011-02995 CVE-2011-3385 · GHSA-r2cf-xf8c-2q7p

Cross-site scripting (XSS) vulnerability in WebsiteBaker before 2.8, as used in LEPTON…

LOW 22

Cross-site scripting (XSS) vulnerability in WebsiteBaker before 2.8, as used in LEPTON and possibly other products, allows remote attackers to inject arbitrary web script or HTML via unknown vectors, a different vulnerab…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.00845 Published 2011-09-02 No fix listed CWE-79

Vulnerabilities

Filters