Vulnerability of “Before and After Photos”: Comparison of images before/after by a content management system (CMS) like 1C-Bitrix. This feature allows unauthorized users to execute arbitrary code by enabling unlimited uploading of dangerous types of files.

Vulnerability of “Before and After Photos”: Comparison of images before/after by a content management system CMS like 1C-Bitrix. Website management involves unlimited uploading of dangerous files. Exploitation of this vulnerability could allow an attacker to execute arbitrary code remotely...

Vulnerability of the “KOMTEK Cassa Kurier” module of the 1C-Bitrix content management system: Website management related to the lack of authentication for critical functions, allowing attackers to compromise the integrity and accessibility of protected information

Vulnerability of the “KOMTEK Cassa Kurier” module of the 1C-Bitrix content management system: Website management is associated with the absence of authentication for a critical function. Exploitation of this vulnerability may allow an attacker to compromise the integrity and accessibility of...

CVE-2025-67887

🛡️ 针对 1C-Битрикс 的 "漏洞" CVE-2025-67887/86 在 перевод 模块中的修复 1С-Битрикс 安全 1С-Битрикс 信息安全与事件监控中心通知 Telegram 频道中出现了一条关于 "Перевод" 模块存在漏洞的消息，据称该漏洞允许未经授权上传档案且不进行安全检查。 我们立即进行了检查，并且 不确认 产品中存在漏洞。只有管理员才能向 "Переводы" 模块上传文件。消息中提到的所需权限与管理员的权限一致。管理员有权修改并在项目上运行任何代码。 因此，该漏洞不存在。 https://t.me/bitrixkiberbez/76...

CVE-2025-67887

CVE-2025-67887 1C-Bitrix = 25.100.500 Translate Module Vulnerabilidad de Ejecución Remota de Código...

CVE-2025-67887: Improper Control of Generation of Code

1C-Bitrix through 25.100.500 allows Remote Code Execution because an actor with SOURCE/WRITE permissions for the Translate Module can upload and execute code by sending a PHP file and a .htaccess file. NOTE: this is disputed by the Supplier because this is intended behavior for the high-privilege...

CVE-2024-34887

Insufficiently protected credentials in AD/LDAP server settings in 1C-Bitrix Bitrix24 23.300.100 allows remote administrators to send AD/LDAP administrators account passwords to an arbitrary server via HTTP POST request...

CVE-2024-34883

Insufficiently protected credentials in DAV server settings in 1C-Bitrix Bitrix24 23.300.100 allow remote administrators to read proxy-server accounts passwords via HTTP GET request...

EUVD-2022-46929

Malicious code in bioql PyPI...

PT-2025-27 · Ооо '1С Битрикс' · Модуль Iblock

Уязвимость модуля iblock системы управления содержимым сайтов CMS 1С-Битрикс: Управление сайтом связана с ошибками при обработке относительного пути к каталогу. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, получить несанкционированный доступ к защищаемой информации...

PT-2025-26 · Ооо '1С Битрикс' · Модуль Iblock

Уязвимость модуля iblock системы управления содержимым сайтов CMS 1С-Битрикс: Управление сайтом связана с ошибками при обработке относительного пути к каталогу. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, получить несанкционированный доступ к защищаемой информации...

PT-2025-28 · Ооо '1С Битрикс' · Модуль Iblock

Уязвимость модуля iblock системы управления содержимым сайтов CMS 1С-Битрикс: Управление сайтом связана с неверным управлением генерацией кода. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, выполнить произвольный код путём его внедрения в произвольный PHP-сценарий,...

The vulnerability of the virtual server “1C-Bitrix: Virtual Machine” involves deficiencies in access control, allowing attackers to elevate their privileges to the root level.

The vulnerability of the virtual server “1C-Bitrix: Virtual Machine” is related to deficiencies in access control. Exploiting this vulnerability can allow a malicious actor to elevate their privileges to the root level...

CVE-2024-34891

Insufficiently protected credentials in DAV server settings in 1C-Bitrix Bitrix24 23.300.100 allows remote administrators to read Exchange account passwords via HTTP GET request...

CVE-2024-34885

Insufficiently protected credentials in SMTP server settings in 1C-Bitrix Bitrix24 23.300.100 allows remote administrators to read SMTP accounts passwords via HTTP GET request...

CVE-2024-34887

Insufficiently protected credentials in AD/LDAP server settings in 1C-Bitrix Bitrix24 23.300.100 allows remote administrators to send AD/LDAP administrators account passwords to an arbitrary server via HTTP POST request...

CVE-2024-34882

Insufficiently protected credentials in SMTP server settings in 1C-Bitrix Bitrix24 23.300.100 allows remote administrators to send SMTP account passwords to an arbitrary server via HTTP POST request...

CVE-2024-34885

Insufficiently protected credentials in SMTP server settings in 1C-Bitrix Bitrix24 23.300.100 allows remote administrators to read SMTP accounts passwords via HTTP GET request...

CVE-2024-34891: Cleartext Storage of Sensitive Information

Insufficiently protected credentials in DAV server settings in 1C-Bitrix Bitrix24 23.300.100 allows remote administrators to read Exchange account passwords via HTTP GET request...

CVE-2024-34885

Insufficiently protected credentials in SMTP server settings in 1C-Bitrix Bitrix24 23.300.100 allows remote administrators to read SMTP accounts passwords via HTTP GET request...

CVE-2024-34883

CVE-2024-34883 affects 1C-Bitrix Bitrix24 v23.300.100. The vulnerability arises from insufficient protection of credentials in the DAV server settings, enabling remote administrators to read proxy-server account passwords via an HTTP GET request. Impact is confidentiality: high. Exploitation deta...