Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Vendor: thirty bees Clear all filters
TI-2026-71030 CVE-2026-109394 · GHSA-p3f5-mhgv-c337

Account takeover in thirty bees via guest checkout password reset

Priority HIGH 74

Thirty bees through 1.7.0 contains an authentication bypass vulnerability in PasswordController::resolveCustomer() that allows unauthenticated attackers to reset registered customers' passwords using guest account tokens…

CVSS 4.0CRITICAL 9.1 Network No auth No interaction EPSS 0.00446 Published 2026-10-12 No fix listed CWE-639
TI-2023-24672 CVE-2023-45957 · GHSA-jjvp-fh9w-628p

A stored cross-site scripting (XSS) vulnerability in the component…

Priority LOW 25

A stored cross-site scripting (XSS) vulnerability in the component admin/AdminRequestSqlController.php of thirty bees before 1.5.0 allows attackers to execute arbitrary web script or HTML via $e->getMessage() error misha…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00375 Published 2023-12-22 No fix listed CWE-79