297 matches found
CVE-2020-26669
A stored cross-site scripting XSS vulnerability was discovered in BigTree CMS 4.4.10 and earlier which allows an authenticated attacker to execute arbitrary web scripts or HTML via the page content to site/index.php/admin/pages/update...
CVE-2020-26668
A SQL injection vulnerability was discovered in /core/feeds/custom.php in BigTree CMS 4.4.10 and earlier which allows an authenticated attacker to inject a malicious SQL query to the applications via the 'Create New Feed' function...
Sql injection
A SQL injection vulnerability was discovered in /core/feeds/custom.php in BigTree CMS 4.4.10 and earlier which allows an authenticated attacker to inject a malicious SQL query to the applications via the 'Create New Feed' function...
Cross site scripting
A stored cross-site scripting XSS vulnerability was discovered in BigTree CMS 4.4.10 and earlier which allows an authenticated attacker to execute arbitrary web scripts or HTML via the page content to site/index.php/admin/pages/update...
Design/Logic Flaw
A vulnerability has been discovered in BigTree CMS 4.4.10 and earlier which allows an authenticated attacker to execute arbitrary commands through a crafted request sent to the server via the 'Create a New Setting' function...
CVE-2020-26670
CVE-2020-26670 affects BigTree CMS up to version 4.4.10. An authenticated attacker can execute arbitrary commands through a crafted request to the server via the Create a New Setting (also described as Create New Setup in some sources) function. The root cause is a command execution vulnerability...
CVE-2020-26670
A vulnerability has been discovered in BigTree CMS 4.4.10 and earlier which allows an authenticated attacker to execute arbitrary commands through a crafted request sent to the server via the 'Create a New Setting' function...
CVE-2020-26669
A stored cross-site scripting XSS vulnerability was discovered in BigTree CMS 4.4.10 and earlier which allows an authenticated attacker to execute arbitrary web scripts or HTML via the page content to site/index.php/admin/pages/update...
CVE-2020-26669
BigTree CMS 4.4.10 and earlier is affected by a stored XSS in the admin pages update path (site/index.php/admin/pages/update). The issue allows an authenticated attacker to inject and execute arbitrary web scripts/HTML via page content. Impact is limited to confidentiality/ integrity depending on...
CVE-2020-26668
A SQL injection vulnerability was discovered in /core/feeds/custom.php in BigTree CMS 4.4.10 and earlier which allows an authenticated attacker to inject a malicious SQL query to the applications via the 'Create New Feed' function...
CVE-2020-26668
BigTree CMS 4.4.10 and earlier contains a SQL injection in /core/feeds/custom.php exploitable via the Create New Feed function by an authenticated user. The vulnerability stems from improper handling of input in that endpoint, allowing injection of malicious SQL queries. Reported impact per CVSS:...
Fastspot BigTree 操作系统命令注入漏洞
BigTree CMS is an open source content management system based on PHP and MySQL. A remote code execution vulnerability exists in BigTree CMS 4.4.10 and earlier versions. The vulnerability can be exploited to execute arbitrary commands by sending a specially crafted request to the server via the...
Fastspot BigTree SQL注入漏洞
BigTree CMS is an open source content management system based on PHP and MySQL. A SQL injection vulnerability exists in /core/feeds/custom.php in BigTree CMS 4.4.10 and earlier versions. An attacker can exploit this vulnerability to inject malicious SQL queries into the application via the 'Creat...
BigTree CMS Remote Code Execution Vulnerability
BigTree CMS is a small open source cms based on PHP and Mysql. A remote code execution vulnerability exists in BigTree CMS. An attacker can exploit the vulnerability to execute arbitrary code...
BigTree CMS 4.4.10 Remote Code Execution
Exploit Title: BigTree CMS 4.4.10 - Remote Code Execution Google Dork: " BigTree CMS " Date: 2020-25-09 Exploit Author: SunCSR ThienNV and HoaVT - Sun Cyber Security Research Vendor Homepage: https://www.bigtreecms.org/ Software Link: https://www.bigtreecms.org/ Version: 4.4.10 Tested on: Windows...
BigTree CMS SQL Injection Vulnerability (CNVD-2019-40510)
BigTree CMS is a small open source cms based on PHP and Mysql. BigTree CMS suffers from a SQL injection vulnerability that can be exploited by attackers to obtain sensitive information...
BigTree CMS Deserialization Vulnerability
BigTree CMS is a small open source cms based on PHP and Mysql. BigTree CMS has a deserialization vulnerability that can be exploited by an attacker to gain control of the web server...
Backend SQL Injection in BigTree CMS 4.4.6
We have scanned one of the latest versions of BigTree CMS 4.4.6 and detected multiple vulnerabilities. Among them is a SQL Injection vulnerability and a Phar Deserialization vulnerability leading to a Remote Code Execution in the small web application. The truncated analysis results are available...
Stored Cross-Site Scripting Vulnerability in BigTree CMS
BigTree CMS is an open source content management system based on PHP and MySQL. A stored cross-site scripting vulnerability exists in BigTree CMS. An attacker can insert malicious js code into a page to obtain user cookies and other information, leading to user hijacking...
BigTree CMS 'parent' SQL Injection Vulnerability
BigTree CMS is an open source content management system based on PHP and MySQL. A SQL injection vulnerability exists in BigTree CMS 'parent'. An attacker can exploit the vulnerability to obtain sensitive database information...