Priority MEDIUM 64
Green CMS 2.x contains a path traversal vulnerability that allows authenticated attackers to download arbitrary files and directories by injecting directory traversal sequences.
CVSS 4.0HIGH 7.1· Network · Low privileges · No interaction · EPSS 0.01145 · Published 2026-03-21 · No fix listed CWE-22
Priority MEDIUM 64
Green CMS 2.x contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code through the cat parameter.
CVSS 4.0HIGH 7.1· Network · Low privileges · No interaction · EPSS 0.00356 · Published 2026-03-21 · No fix listed CWE-89
Priority MEDIUM 56
A vulnerability was found in GreenCMS up to 2.3.
CVSS 4.0MEDIUM 5.1· Network · High privileges · No interaction · EPSS 0.00682 · Published 2025-12-29 · No fix listed CWE-22
Priority MEDIUM 55
A flaw has been found in GreenCMS 2.3.0603.
CVSS 4.0MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.00272 · Published 2025-12-08 · No fix listed CWE-79
Priority MEDIUM 57
A vulnerability was identified in GreenCMS up to 2.3.0603.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00365 · Published 2025-08-25 · No fix listed CWE-284
Priority MEDIUM 58
A stored cross-site scripting (XSS) vulnerability in /install.php?m=install&c=index&a=step3 of GreenCMS v2.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00277 · Published 2024-01-29 · No fix listed CWE-79
Priority LOW 37
Cross Site Request Forgery vulnerability in GreenCMS v.2.3 allows an attacker to gain privileges via the adduser function of index.php.
CVSS 3.1HIGH 8.0· Network · Low privileges · User interaction · EPSS 0.00325 · Published 2023-06-20 · No fix listed CWE-352
Priority LOW 37
GreenCMS v2.3.0603 was discovered to contain an arbitrary file deletion vulnerability via /index.php?m=admin&c=custom&a=plugindelhandle&plugin_name=.
CVSS 3.1HIGH 8.1· Network · Low privileges · No interaction · EPSS 0.01077 · Published 2022-04-26 · No fix listed
Priority MEDIUM 47
GreenCMS 2.3.0603 allows remote attackers to obtain sensitive information via a direct request for Data/Log/year_month_day.log.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.12727 · Published 2018-06-20 · No fix listed CWE-532
Priority MEDIUM 43
An issue was discovered in GreenCMS v2.3.0603.
CVSS 3.0HIGH 8.8· Network · No auth · User interaction · EPSS 0.02392 · Published 2018-06-01 · No fix listed CWE-352
Priority MEDIUM 43
An issue was discovered in GreenCMS v2.3.0603.
CVSS 3.0HIGH 8.8· Network · No auth · User interaction · EPSS 0.02392 · Published 2018-06-01 · No fix listed CWE-352
THREATIST.IORead the docs