b2evolution b2evolution vulnerabilities and exploits

(subscribe to this query)

NA

SQL injection vulnerability in blogs/admin.php in b2evolution prior to 4.1.7 allows remote authenticated administrators to execute arbitrary SQL commands via the show_statuses[] parameter. NOTE: this can be leveraged using CSRF to allow remote unauthenticated malicious users to e...

B2evolution B2evolution 4.1.5 B2evolution B2evolution 4.1.4 B2evolution B2evolution 4.1.3 B2evolution B2evolution 4.1.2 B2evolution B2evolution B2evolution B2evolution 4.1.1 B2evolution B2evolution 4.1.0

1 EDB exploit

NA

Cross-site request forgery (CSRF) vulnerability in blogs/admin.php in b2evolution prior to 4.1.7 allows remote malicious users to hijack the authentication of administrators for requests that conduct SQL injection attacks via the show_statuses[] parameter, related to CVE-2013-294...

B2evolution B2evolution B2evolution B2evolution 4.1.5 B2evolution B2evolution 4.1.4 B2evolution B2evolution 4.1.2 B2evolution B2evolution 4.1.0 B2evolution B2evolution 4.1.3 B2evolution B2evolution 4.1.1

NA

PHP remote file inclusion vulnerability in inc/CONTROL/import/import-mt.php in b2evolution 1.8.5 up to and including 1.9 beta allows remote malicious users to execute arbitrary PHP code via a URL in the inc_path parameter.

B2evolution B2evolution 1.9 Beta B2evolution B2evolution 1.8.5 B2evolution B2evolution 1.9

1 EDB exploit

NA

Cross-site scripting (XSS) vulnerability in htsrv/login.php in b2evolution 1.8.6 allows remote malicious users to inject arbitrary web script or HTML via scriptable attributes in the redirect_to parameter.

B2evolution B2evolution 1.8.6 B2evolution B2evolution 1.8.2 B2evolution B2evolution 1.8.5

NA

Multiple cross-site scripting (XSS) vulnerabilities in b2evolution 1.8.2 up to and including 1.9 beta allow remote malicious users to inject arbitrary web script or HTML via the (1) app_name parameter in (a) _404_not_found.page.php, (b) _410_stats_gone.page.php, and (c) _referer_...

B2evolution B2evolution 1.9 Beta B2evolution B2evolution 1.8.2

3 EDB exploits

NA

Multiple SQL injection vulnerabilities in the Starrating plugin prior to 0.7.7 for b2evolution allow remote malicious users to execute arbitrary SQL commands via unspecified vectors.

B2evolution Starrating Plugin B2evolution Starrating Plugin 0.7.5 B2evolution Starrating Plugin 0.7 B2evolution Starrating Plugin 0.6

4.8

CVSSv3

Stored XSS in b2evolution CMS version 6.11.6 and prior allows an malicious user to perform malicious JavaScript code execution via the plugin name input field in the plugin module.

B2evolution B2evolution

6.1

CVSSv3

Open redirect vulnerability in b2evolution CMS version before 6.11.6 allows an malicious user to perform malicious open redirects to an attacker controlled resource via redirect_to parameter in email_passthrough.php.

B2evolution B2evolution

NA

Multiple PHP remote file inclusion vulnerabilities in b2evolution allow remote malicious users to execute arbitrary PHP code via a URL in the (1) inc_path parameter to (a) a_noskin.php, (b) a_stub.php, (c) admin.php, (d) contact.php, (e) default.php, (f) index.php, and (g) multib...

B2evolution B2evolution

8.1

CVSSv3

Directory traversal vulnerability in inc/files/files.ctrl.php in b2evolution up to and including 6.8.3 allows remote authenticated users to read or delete arbitrary files by leveraging back-office access to provide a .. (dot dot) in the fm_selected array parameter.

B2evolution B2evolution

Get Started

1 2 3 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook