531 matches found
CVE-2018-18380
CVE-2018-18380 affects BigTree (Bigtree) CMS prior to 4.2.24. The admin.php flow accepts a user-supplied PHP session ID after login instead of regenerating a new one, enabling session hijacking (session fixation). Documents indicate this is fixed in 4.2.24; remediation is to upgrade to 4.2.24 or ...
PT-2018-14426
Name of the Vulnerable Software and Affected Versions Bigtree versions prior to 4.2.24 Description A Session Fixation issue allows an attacker to hijack an admin session by accepting a user-provided PHP session ID instead of regenerating a new one after a user has logged in to the application...
CVE-2018-18380: Session Fixation
A Session Fixation issue was discovered in Bigtree before 4.2.24. admin.php accepts a user-provided PHP session ID instead of regenerating a new one after a user has logged in to the application. The Session Fixation could allow an attacker to hijack an admin session...
BigTree CMS cross-site scripting vulnerability (CNVD-2018-21319)
Fastspot BigTree is the United States Fastspot company based on PHP and MySQL open source content management system CMS. A cross-site scripting vulnerability exists in /admin/ajax/file-browser/upload/ in Fastspot BigTree version 4.2.23. A remote attacker can exploit this vulnerability to inject...
BigTree CMS 4.2.23 - Cross-Site Scripting
BigTree CMS 4.2.23 - Cross-Site Scripting Exploit Title: BigTree CMS 4.2.23 - Cross-Site Scripting Date: 2018-10-15 Exploit Author: Ismail Tasdelen Vendor Homepage: https://www.bigtreecms.org/ Software Link : https://github.com/bigtreecms/BigTree-CMS/ Software : BigTree CMS Version : 4.2.23...
BigTree CMS 4.2.23 - Cross-Site Scripting
Exploit Title: BigTree CMS 4.2.23 - Cross-Site Scripting Date: 2018-10-15 Exploit Author: Ismail Tasdelen Vendor Homepage: https://www.bigtreecms.org/ Software Link : https://github.com/bigtreecms/BigTree-CMS/ Software : BigTree CMS Version : 4.2.23 Vulernability Type : Cross-site Scripting...
CVE-2018-18308
In the 4.2.23 version of BigTree, a Stored XSS vulnerability has been discovered in /admin/ajax/file-browser/upload/ aka the image upload area...
CVE-2018-18308
In the 4.2.23 version of BigTree, a Stored XSS vulnerability has been discovered in /admin/ajax/file-browser/upload/ aka the image upload area...
Cross site scripting
In the 4.2.23 version of BigTree, a Stored XSS vulnerability has been discovered in /admin/ajax/file-browser/upload/ aka the image upload area...
CVE-2018-18308
In the 4.2.23 version of BigTree, a Stored XSS vulnerability has been discovered in /admin/ajax/file-browser/upload/ aka the image upload area...
CVE-2018-18308
BigTree CMS 4.2.23 contains a Stored XSS vulnerability in the image-upload path /admin/ajax/file-browser/upload/. The issue arises in the image upload handling, allowing an attacker to inject arbitrary web script/HTML via the upload mechanism. Public references (Exploit-DB, CNVD, CNVD-like entrie...
CVE-2018-18308
In the 4.2.23 version of BigTree, a Stored XSS vulnerability has been discovered in /admin/ajax/file-browser/upload/ aka the image upload area...
PT-2018-14398
Name of the Vulnerable Software and Affected Versions BigTree version 4.2.23 Description A Stored XSS issue has been found in the image upload area, specifically at the "/admin/ajax/file-browser/upload/" API endpoint. Recommendations For BigTree version 4.2.23, update to a newer version that...
CVE-2018-18308: Improper Neutralization of Input During Web Page Generation
In the 4.2.23 version of BigTree, a Stored XSS vulnerability has been discovered in /admin/ajax/file-browser/upload/ aka the image upload area...
BigTree CMS 4.2.23 Cross Site Scripting Vulnerability
Exploit for php platform in category web applications Exploit Title: BigTree CMS 4.2.23 - Cross-Site Scripting Exploit Author: Ismail Tasdelen Vendor Homepage: https://www.bigtreecms.org/ Software Link : https://github.com/bigtreecms/BigTree-CMS/ Software : BigTree CMS Version : 4.2.23...
BigTree CMS 4.2.23 Cross Site Scripting
Exploit Title: BigTree CMS 4.2.23 - Cross-Site Scripting Date: 2018-10-15 Exploit Author: Ismail Tasdelen Vendor Homepage: https://www.bigtreecms.org/ Software Link : https://github.com/bigtreecms/BigTree-CMS/ Software : BigTree CMS Version : 4.2.23 Vulernability Type : Cross-site Scripting...
CVE-2018-17341
BigTree 4.2.23 on Windows, when Advanced or Simple Rewrite routing is enabled, allows remote attackers to bypass authentication via a ..\ substring, as demonstrated by a launch.php?bigtreehtaccessurl=admin/images/..\ URI...
CVE-2018-17341
BigTree 4.2.23 on Windows, when Advanced or Simple Rewrite routing is enabled, allows remote attackers to bypass authentication via a ..\ substring, as demonstrated by a launch.php?bigtreehtaccessurl=admin/images/..\ URI...
Authentication flaw
BigTree 4.2.23 on Windows, when Advanced or Simple Rewrite routing is enabled, allows remote attackers to bypass authentication via a ..\ substring, as demonstrated by a launch.php?bigtreehtaccessurl=admin/images/..\ URI...
CVE-2018-17341
BigTree 4.2.23 on Windows, when Advanced or Simple Rewrite routing is enabled, allows remote attackers to bypass authentication via a ..\ substring, as demonstrated by a launch.php?bigtreehtaccessurl=admin/images/..\ URI...