Vulnerabilities

TI-2026-80387 CVE-2026-116213 · GHSA-ggmg-wv8x-pc69

Arbitrary file read in Webasyst Framework via theme symlinks

LOW 31

Webasyst Framework through 4.4.0 contains an arbitrary file read vulnerability in waArchiveTar::writeItem() that creates symlinks from theme archives without validating link targets.

CVSS 4.0MEDIUM 6.9 Network High privileges No interaction EPSS 0.00448 Published 2026-10-26 No fix listed CWE-59

TI-2026-80386 CVE-2026-116212 · GHSA-5j2p-3grc-r3fc

Stored cross-site scripting in Webasyst Framework Photos app

MEDIUM 56

Webasyst Framework through 4.4.0 contains a stored cross-site scripting vulnerability in the Photos app that allows authenticated backend users to inject JavaScript via the album url parameter.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00171 Published 2026-10-26 No fix listed CWE-79

TI-2026-80385 CVE-2026-116210 · GHSA-j7f6-9r44-r4f9

Cross-site request forgery in Webasyst Framework Photos app

MEDIUM 64

Webasyst Framework through 4.4.0 contains a cross-site request forgery vulnerability in the Photos app that allows remote attackers to perform backend actions because the app does not enable the framework's opt-in CSRF c…

CVSS 4.0HIGH 7.1 Network No auth User interaction EPSS 0.00173 Published 2026-10-26 No fix listed CWE-352

TI-2024-18291 CVE-2024-27517 · GHSA-rvm5-7cc2-vjp9

Webasyst 2.9.9 has a Cross-Site Scripting (XSS) vulnerability, Attackers can create blogs…

MEDIUM 58

Webasyst 2.9.9 has a Cross-Site Scripting (XSS) vulnerability, Attackers can create blogs containing malicious code after gaining blog permissions.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00426 Published 2024-02-28 No fix listed CWE-79

TI-2014-06888 CVE-2014-8377 · GHSA-4287-jrmh-3f8x

Cross-site scripting (XSS) vulnerability in Webasyst Shop-Script 5.2.2.30933 allows…

LOW 23

Cross-site scripting (XSS) vulnerability in Webasyst Shop-Script 5.2.2.30933 allows remote attackers to inject arbitrary web script or HTML via the phone number field in a new contact to phpecom/index.php/webasyst/contac…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01427 Published 2014-10-21 No fix listed CWE-79

TI-2010-04582 CVE-2010-4859 · GHSA-gfm8-q2c2-q3gf

SQL injection vulnerability in index.php in WebAsyst Shop-Script allows remote attackers…

LOW 35

SQL injection vulnerability in index.php in WebAsyst Shop-Script allows remote attackers to execute arbitrary SQL commands via the blog_id parameter in a news action.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.01154 Published 2011-10-05 No fix listed CWE-89

TI-2010-01417 CVE-2010-1464 · GHSA-cq2c-xv58-j963

Multiple cross-site scripting (XSS) vulnerabilities in WebAsyst Shop-Script FREE allow…

LOW 22

Multiple cross-site scripting (XSS) vulnerabilities in WebAsyst Shop-Script FREE allow remote attackers to inject arbitrary web script or HTML via the (1) currency_id_left, (2) currency_id_right, (3) darkcolor, (4) light…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01022 Published 2010-04-16 No fix listed CWE-79