Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
b2evolution vulnerabilities and exploits
(subscribe to this query)
9.1
CVSSv3
CVE-2022-30935
An authorization bypass in b2evolution allows remote, unauthenticated malicious users to predict password reset tokens for any user through the use of a bad randomness function. This allows the malicious user to get valid sessions for arbitrary users, and optionally reset their p...
B2evolution B2evolution
7.5
CVSSv3
CVE-2016-9479
The "lost password" functionality in b2evolution prior to 6.7.9 allows remote malicious users to reset arbitrary user passwords via a crafted request.
B2evolution B2evolution
6.1
CVSSv3
CVE-2016-7149
Cross-site scripting (XSS) vulnerability in b2evolution 6.7.5 and previous versions allows remote malicious users to inject arbitrary web script or HTML via vectors related to the autolink function.
B2evolution B2evolution
5.4
CVSSv3
CVE-2016-7150
Cross-site scripting (XSS) vulnerability in b2evolution 6.7.5 and previous versions allows remote authenticated users to inject arbitrary web script or HTML via the site name.
B2evolution B2evolution
NA
CVE-2014-9599
Cross-site scripting (XSS) vulnerability in the filemanager in b2evolution prior to 5.2.1 allows remote malicious users to inject arbitrary web script or HTML via the fm_filter parameter to blogs/admin.php.
B2evolution B2evolution
5.4
CVSSv3
CVE-2017-5494
Multiple cross-site scripting (XSS) vulnerabilities in the file types table in b2evolution up to and including 6.8.3 allow remote authenticated users to inject arbitrary web script or HTML via a .swf file in a (1) comment frame or (2) avatar frame.
B2evolution B2evolution
5.4
CVSSv3
CVE-2017-5553
Cross-site scripting (XSS) vulnerability in plugins/markdown_plugin/_markdown.plugin.php in b2evolution prior to 6.8.5 allows remote authenticated users to inject arbitrary web script or HTML via a javascript: URL.
B2evolution B2evolution
9.8
CVSSv3
CVE-2017-1000423
b2evolution version 6.6.0 - 6.8.10 is vulnerable to input validation (backslash and single quote escape) in basic install functionality resulting in unauthenticated attacker gaining PHP code execution on the victim's setup.
B2evolution B2evolution
8.8
CVSSv3
CVE-2021-28242
SQL Injection in the "evoadm.php" component of b2evolution v7.2.2-stable allows remote malicious users to obtain sensitive database information by injecting SQL commands into the "cf_name" parameter when creating a new filter under the "Collections" ...
B2evolution B2evolution 7.2.2
NA
CVE-2012-5910
SQL injection vulnerability in blogs/htsrv/viewfile.php in b2evolution 4.1.3 allows remote authenticated users to execute arbitrary SQL commands via the root parameter.
B2evolution B2evolution 4.1.3
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
path traversal
CVE-2024-26978
CVE-2024-26982
wireless
CVE-2023-6949
CVE-2024-26980
CVE-2024-32766
CVE-2024-26939
cache poisoning
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
1
2
3
NEXT »