Vulmon
Recent Vulnerabilities
Product List
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
b2evolution b2evolution vulnerabilities and exploits
(subscribe to this query)
3.5
CVSSv2
CVE-2017-5494
Multiple cross-site scripting (XSS) vulnerabilities in the file types table in b2evolution up to and including 6.8.3 allow remote authenticated users to inject arbitrary web script or HTML via a .swf file in a (1) comment frame or (2) avatar frame.
B2evolution B2evolution
7.5
CVSSv2
CVE-2017-1000423
b2evolution version 6.6.0 - 6.8.10 is vulnerable to input validation (backslash and single quote escape) in basic install functionality resulting in unauthenticated attacker gaining PHP code execution on the victim's setup.
B2evolution B2evolution
5.8
CVSSv2
CVE-2020-22840
Open redirect vulnerability in b2evolution CMS version before 6.11.6 allows an malicious user to perform malicious open redirects to an attacker controlled resource via redirect_to parameter in email_passthrough.php.
B2evolution B2evolution
3.5
CVSSv2
CVE-2020-22841
Stored XSS in b2evolution CMS version 6.11.6 and prior allows an malicious user to perform malicious JavaScript code execution via the plugin name input field in the plugin module.
B2evolution B2evolution
5.5
CVSSv2
CVE-2017-5480
Directory traversal vulnerability in inc/files/files.ctrl.php in b2evolution up to and including 6.8.3 allows remote authenticated users to read or delete arbitrary files by leveraging back-office access to provide a .. (dot dot) in the fm_selected array parameter.
B2evolution B2evolution
NA
CVE-2022-30935
An authorization bypass in b2evolution allows remote, unauthenticated malicious users to predict password reset tokens for any user through the use of a bad randomness function. This allows the malicious user to get valid sessions for arbitrary users, and optionally reset their p...
B2evolution B2evolution
5
CVSSv2
CVE-2016-9479
The "lost password" functionality in b2evolution prior to 6.7.9 allows remote malicious users to reset arbitrary user passwords via a crafted request.
B2evolution B2evolution
7.5
CVSSv2
CVE-2009-1657
Multiple SQL injection vulnerabilities in the Starrating plugin prior to 0.7.7 for b2evolution allow remote malicious users to execute arbitrary SQL commands via unspecified vectors.
B2evolution Starrating Plugin
B2evolution Starrating Plugin 0.6
B2evolution Starrating Plugin 0.7
B2evolution Starrating Plugin 0.7.5
9
CVSSv2
CVE-2017-5539
The patch for directory traversal (CVE-2017-5480) in b2evolution version 6.8.4-stable has a bypass vulnerability. An attacker can use ..\/ to bypass the filter rule. Then, this attacker can exploit this vulnerability to delete or read any files on the server. It can also be used ...
B2evolution B2evolution 6.8.4
6.5
CVSSv2
CVE-2012-5910
SQL injection vulnerability in blogs/htsrv/viewfile.php in b2evolution 4.1.3 allows remote authenticated users to execute arbitrary SQL commands via the root parameter.
B2evolution B2evolution 4.1.3
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-30078
CVE-2024-37896
code injection
CVE-2024-3080
CVE-2024-5172
cross-site request forgery
CVE-2024-6111
firmware
CVE-2024-38504
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
1
2
3
NEXT »