Vulnerabilities

TI-2012-01107 CVE-2012-1203 · GHSA-3xr9-3mv7-j749

Cross-site request forgery (CSRF) vulnerability in starnet/index.php in SyndeoCMS 3.0 and…

LOW 32

Cross-site request forgery (CSRF) vulnerability in starnet/index.php in SyndeoCMS 3.0 and earlier allows remote attackers to hijack the authentication of administrators for requests that add user accounts via a save_user…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.0106 Published 2014-12-28 No fix listed CWE-352

TI-2012-01756 CVE-2012-1979 · GHSA-8484-g3mc-3mr8

Cross-site scripting (XSS) vulnerability in starnet/index.php in SyndeoCMS 3.0.01 and…

LOW 20

Cross-site scripting (XSS) vulnerability in starnet/index.php in SyndeoCMS 3.0.01 and earlier allows remote authenticated users to inject arbitrary web script or HTML via the email parameter (aka Email address field) in…

CVSS 2.0LOW 3.5 Network Low privileges Interaction — EPSS 0.01656 Published 2012-04-17 No fix listed CWE-79

TI-2008-05017 CVE-2008-5272 · GHSA-pgmj-qh68-v58c

Multiple directory traversal vulnerabilities in Fred Stuurman SyndeoCMS 2.6.0 allow…

LOW 27

Multiple directory traversal vulnerabilities in Fred Stuurman SyndeoCMS 2.6.0 allow remote authenticated users to read arbitrary files via a ..

CVSS 2.0MEDIUM 4.0 Network Low privileges Interaction — EPSS 0.05618 Published 2008-11-28 No fix listed CWE-22

TI-2008-05016 CVE-2008-5271 · GHSA-r6cr-6ccc-jjpj

Cross-site scripting (XSS) vulnerability in index.php in Fred Stuurman SyndeoCMS 2.6.0…

LOW 23

Cross-site scripting (XSS) vulnerability in index.php in Fred Stuurman SyndeoCMS 2.6.0 allows remote attackers to inject arbitrary web script or HTML via the section parameter.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01524 Published 2008-11-28 No fix listed CWE-79

TI-2007-05606 CVE-2007-5840 · GHSA-47qg-45wp-9cgc

PHP remote file inclusion vulnerability in starnet/themes/c-sky/main.inc.php in Fred…

LOW 36

PHP remote file inclusion vulnerability in starnet/themes/c-sky/main.inc.php in Fred Stuurman SyndeoCMS 2.5.01 allows remote attackers to execute arbitrary PHP code via a URL in the cmsdir parameter, a different vector t…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.03178 Published 2007-11-06 No fix listed CWE-94