Vulnerabilities

TI-2022-07105 CVE-2022-22914 · GHSA-2f7g-8vxw-jmrr

An incorrect access control issue in the component FileManager of Ovidentia CMS 6.0…

LOW 36

An incorrect access control issue in the component FileManager of Ovidentia CMS 6.0 allows authenticated attackers to to view and download content in the upload directory via path traversal.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01401 Published 2022-02-17 No fix listed CWE-22

TI-2021-10101 CVE-2021-29343 · GHSA-49jv-774c-9fh3

Ovidentia CMS 6.x contains a SQL injection vulnerability in the "id" parameter of…

LOW 26

Ovidentia CMS 6.x contains a SQL injection vulnerability in the "id" parameter of index.php.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00751 Published 2021-03-30 No fix listed CWE-89

TI-2019-10427 CVE-2019-13978 · GHSA-7h58-73jc-qc83

Ovidentia 8.4.3 has SQL Injection via the id parameter in an index.php?tg=delegat&idx=mem request.

MEDIUM 41

Ovidentia 8.4.3 has SQL Injection via the id parameter in an index.php?tg=delegat&idx=mem request.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.01462 Published 2019-07-19 No fix listed CWE-89

TI-2019-10426 CVE-2019-13977 · GHSA-4jhf-wc6q-v8gq

index.php in Ovidentia 8.4.3 has XSS via tg=groups…

LOW 27

index.php in Ovidentia 8.4.3 has XSS via tg=groups, tg=maildoms&idx=create&userid=0&bgrp=y, tg=delegat, tg=site&idx=create, tg=site&item=4, tg=admdir&idx=mdb&id=1, tg=notes&idx=Create, tg=admfaqs&idx=Add, or tg=admoc&idx…

CVSS 3.0MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01505 Published 2019-07-19 No fix listed CWE-79

TI-2018-15973 CVE-2018-1000619 · GHSA-59c9-ppc4-4v7h

Ovidentia version 8.4.3 and earlier contains a Unsanitized User Input vulnerability in…

MEDIUM 43

Ovidentia version 8.4.3 and earlier contains a Unsanitized User Input vulnerability in utilit.php, bab_getAddonFilePathfromTg that can result in Authenticated Remote Code Execution.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.02316 Published 2018-07-09 No fix listed CWE-434

TI-2008-04218 CVE-2008-4423 · GHSA-wcmp-q6x5-gv25

SQL injection vulnerability in index.php in Ovidentia 6.6.5 allows remote attackers to…

LOW 31

SQL injection vulnerability in index.php in Ovidentia 6.6.5 allows remote attackers to execute arbitrary SQL commands via the item parameter in a contact modify action.

CVSS 2.0MEDIUM 6.5 Network Low privileges Interaction — EPSS 0.01094 Published 2008-10-03 No fix listed CWE-89

TI-2008-03757 CVE-2008-3918 · GHSA-h454-7w34-3fjm

SQL injection vulnerability in index.php in Ovidentia 6.6.5 allows remote attackers to…

LOW 35

SQL injection vulnerability in index.php in Ovidentia 6.6.5 allows remote attackers to execute arbitrary SQL commands via the field parameter in a search action.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.00913 Published 2008-09-04 No fix listed CWE-89

TI-2008-03756 CVE-2008-3917 · GHSA-qh53-3xcq-hff8

Cross-site scripting (XSS) vulnerability in index.php in Ovidentia 6.6.5 allows remote…

LOW 23

Cross-site scripting (XSS) vulnerability in index.php in Ovidentia 6.6.5 allows remote attackers to inject arbitrary web script or HTML via the field parameter in a search action.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01507 Published 2008-09-04 No fix listed CWE-79

Vulnerabilities

Filters