CVE-2017-6914: Cross-Site Request Forgery (CSRF)

CSRF exists in BigTree CMS 4.1.18 and 4.2.16 with the id parameter to the admin/ajax/users/delete/ page. A user can be deleted...

PT-2017-17413

Name of the Vulnerable Software and Affected Versions BigTree CMS version 4.1.18 Description The issue concerns a CSRF problem. It affects the "admin/settings/update/" page, specifically with the nav-social parameter. This allows an attacker to change the Navigation Social settings. Recommendatio...

PT-2017-17411

Name of the Vulnerable Software and Affected Versions BigTree CMS versions 4.1.18 through 4.2.16 Description The issue concerns a CSRF problem. It affects the "admin/ajax/users/delete/" page, specifically with the id parameter. This allows an unauthorized user deletion. Recommendations For BigTre...

PT-2017-17414

Name of the Vulnerable Software and Affected Versions BigTree CMS version 4.2.16 Description The issue concerns a CSRF problem. It affects the "admin/settings/update/" page, specifically with the value parameter. This allows an attacker to change the Colophon. Recommendations For BigTree CMS...

PT-2017-17412

Name of the Vulnerable Software and Affected Versions BigTree CMS version 4.1.18 Description The issue concerns a CSRF problem. It affects the "admin/settings/update/" page, specifically with the colophon parameter. This allows the Colophon to be changed. Recommendations For BigTree CMS version...

PT-2017-17415

Name of the Vulnerable Software and Affected Versions BigTree CMS version 4.2.16 Description A CSRF issue exists, allowing the Navigation Social to be changed by manipulating the value parameter in the "admin/settings/update/" page. Recommendations For BigTree CMS version 4.2.16, as a temporary...

CVE-2017-6918: Cross-Site Request Forgery (CSRF)

CSRF exists in BigTree CMS 4.2.16 with the value parameter to the admin/settings/update/ page. The Navigation Social can be changed...

CVE-2017-6915: Cross-Site Request Forgery (CSRF)

CSRF exists in BigTree CMS 4.1.18 with the colophon parameter to the admin/settings/update/ page. The Colophon can be changed...

CVE-2017-6916: Cross-Site Request Forgery (CSRF)

CSRF exists in BigTree CMS 4.1.18 with the nav-social parameter to the admin/settings/update/ page. The Navigation Social can be changed...

CVE-2017-6917: Cross-Site Request Forgery (CSRF)

CSRF exists in BigTree CMS 4.2.16 with the value parameter to the admin/settings/update/ page. The Colophon can be changed...

Fastspot BigTree CMS Input Validation Vulnerability

Fastspot BigTree CMS is the United States Fastspot company based on PHP and MySQL open source content management system CMS. An input validation vulnerability exists in Fastspot BigTree CMS versions prior to 4.2.15, which stems from a failure of the program to adequately filter the id HTTP GET...

BigTree CMS Potential XSS Attack

BigTree CMS is prone to an XSS vulnerability due to an improper validation of input. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Design/Logic Flaw

An issue was discovered in BigTree CMS before 4.2.15. The vulnerability exists due to insufficient filtration of user-supplied data in the "id" HTTP GET parameter passed to the "core/admin/adjax/dashboard/check-module-integrity.php" URL. An attacker could execute arbitrary HTML and script code in...

CVE-2016-10223

An issue was discovered in BigTree CMS before 4.2.15. The vulnerability exists due to insufficient filtration of user-supplied data in the "id" HTTP GET parameter passed to the "core/admin/adjax/dashboard/check-module-integrity.php" URL. An attacker could execute arbitrary HTML and script code in...

CVE-2016-10223

An issue was discovered in BigTree CMS before 4.2.15. The vulnerability exists due to insufficient filtration of user-supplied data in the "id" HTTP GET parameter passed to the "core/admin/adjax/dashboard/check-module-integrity.php" URL. An attacker could execute arbitrary HTML and script code in...

CVE-2016-10223

An issue was discovered in BigTree CMS before 4.2.15. The vulnerability exists due to insufficient filtration of user-supplied data in the "id" HTTP GET parameter passed to the "core/admin/adjax/dashboard/check-module-integrity.php" URL. An attacker could execute arbitrary HTML and script code in...

CVE-2016-10223

An issue was discovered in BigTree CMS before 4.2.15. The vulnerability exists due to insufficient filtration of user-supplied data in the "id" HTTP GET parameter passed to the "core/admin/adjax/dashboard/check-module-integrity.php" URL. An attacker could execute arbitrary HTML and script code in...

CVE-2016-10223

CVE-2016-10223 – BigTree CMS XSS in id parameter . Affected software: BigTree CMS prior to 4.2.15. The vulnerability stems from insufficient filtration of user-supplied data in the GET parameter id passed to core/admin/adjax/dashboard/check-module-integrity.php, allowing an attacker to inject arb...

CVE-2016-10223: Improper Access Control

An issue was discovered in BigTree CMS before 4.2.15. The vulnerability exists due to insufficient filtration of user-supplied data in the "id" HTTP GET parameter passed to the "core/admin/adjax/dashboard/check-module-integrity.php" URL. An attacker could execute arbitrary HTML and script code in...

PT-2017-7820

Name of the Vulnerable Software and Affected Versions BigTree CMS versions prior to 4.2.15 Description The issue is caused by insufficient filtration of user-supplied data in the id HTTP GET parameter passed to the "core/admin/adjax/dashboard/check-module-integrity.php" API endpoint. This allows ...