1C-Bitrix Before and After Photos Code Execution

Vulnerability of “Before and After Photos”: Comparison of images before/after by a content management system CMS like 1C-Bitrix. Website management involves unlimited uploading of dangerous files. Exploitation of this vulnerability could allow an attacker to execute arbitrary code remotely...

KOMTEK Cassa Kurier Module Authentication Bypass

Vulnerability of the “KOMTEK Cassa Kurier” module of the 1C-Bitrix content management system: Website management is associated with the absence of authentication for a critical function. Exploitation of this vulnerability may allow an attacker to compromise the integrity and accessibility of...

Bitrix Site Manager 6.5 - Open Redirect

Bitrix Site Manager 6.5 contains an open redirect vulnerability in redirect.php. Remote attackers can redirect users to arbitrary web sites and conduct phishing attacks via a URL in the goto parameter. id: CVE-2008-2052 info: name: Bitrix Site Manager 6.5 - Open Redirect author:...

Bitrix24 <=20.0.0 - Cross-Site Scripting

The Web Application Firewall in Bitrix24 up to and including 20.0.0 allows XSS via the itemsITEMSID parameter to the components/bitrix/mobileapp.list/ajax.php/ URI. id: CVE-2020-13483 info: name: Bitrix24 20.0.0 to mitigate this vulnerability. reference: -...

Bitrix Site Manager - Remote Code Execution

In the vote aka "Polls, Votes" module before 21.0.100 of Bitrix Site Manager, a remote unauthenticated attacker can execute arbitrary code. id: CVE-2022-27228 info: name: Bitrix Site Manager - Remote Code Execution author: theamanrawat severity: critical description: In the vote aka "Polls, Votes...

CVE-2025-67887

🛡️ Fix for the "vulnerability" CVE-2025-67887/86 in the 1C-Bitrix Translate module 1C-Bitrix Security The Information Security and Incident Monitoring Center of 1C-Bitrix informs Information appeared in Telegram channels about a vulnerability in the "Translate" module allegedly allowing...

CVE-2025-67887

CVE-2025-67887 1C-Bitrix = 25.100.500 Translate Module Remote Code Execution Vulnerability...

Bitrix24 <=20.0.0 - Cross-Site Scripting Detection

The Web Application Firewall in Bitrix24 up to and including 20.0.0 allows XSS via the itemsITEMSID parameter to the components/bitrix/mobileapp.list/ajax.php/ URI. !/usr/bin/env python3 -- coding: utf-8 -- """The Web Application Firewall in Bitrix24 up to and including 20.""" from kittysploit...

PT-2026-82343

Уязвимость модуля «КОМТЕТ Касса Курьер» системы управления содержимым сайтов CMS 1С-Битрикс: Управление сайтом связана с отсутствием аутентификации для критичной функции. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, оказать воздействие на целостность и доступность...

PT-2026-86291

Уязвимость модуля «Фото До и После: сравнение изображений до/после» системы управления содержимым сайтов CMS 1С-Битрикс: Управление сайтом связана с неограниченной загрузкой файлов опасного типа. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, выполнить произвольный код...

PT-2026-65337

Уязвимость модуля «Редактор для контент-менеджеров» системы управления содержимым сайтов CMS 1С-Битрикс: Управление сайтом связана с неполной очисткой временных или вспомогательных ресурсов. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, выполнить произвольный код...

1C-Bitrix Geo: Employee Birthdays SQL Injection

Vulnerability of the “Geo: Employee Birthdays” module in the Content Management System CMS of 1C-Bitrix: Failure to protect the SQL query structure allows an attacker to execute arbitrary code remotely...

GEO Categories SQL Injection Code Execution

Vulnerability of the “GEO: Categories and search for lists and business processes” module of the website content management system CMS 1C-Bitrix: Website management involves failing to protect the SQL query structure. Exploiting this vulnerability may allow a malicious actor to execute arbitrary...

iHead: Logs Module Code Execution

Vulnerability of the “iHead: Logs” module in the Content Management System CMS of 1C-Bitrix: Website management is related to the failure to protect the structure of web pages. Exploiting this vulnerability may allow a malicious actor to execute arbitrary code remotely...

PT-2026-52155

Уязвимость модуля «iHead: Логи» системы управления содержимым сайтов CMS 1С-Битрикс: Управление сайтом связана с непринятием мер по защите структуры веб-страницы. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, выполнить произвольный код...

Yandex SpeechKit CMS Authentication Bypass

Vulnerability of the “Yandex SpeechKit” module in the Content Management System CMS of 1C-Bitrix: Website management is associated with the absence of authentication for critical functions. Exploiting this vulnerability may allow a malicious actor to compromise the confidentiality, integrity, and...

CVE-2025-67887

1C-Bitrix through 25.100.500 allows Remote Code Execution because an actor with SOURCE/WRITE permissions for the Translate Module can upload and execute code by sending a PHP file and a .htaccess file. NOTE: this is disputed by the Supplier because this is intended behavior for the high-privilege...

EUVD-2025-209735

1C-Bitrix through 25.100.500 allows Remote Code Execution because an actor with SOURCE/WRITE permissions for the Translate Module can upload and execute code by sending a PHP file and a .htaccess file. NOTE: this is disputed by the Supplier because this is intended behavior for the high-privilege...

CVE-2025-67887

1C-Bitrix through 25.100.500 allows Remote Code Execution because an actor with SOURCE/WRITE permissions for the Translate Module can upload and execute code by sending a PHP file and a .htaccess file. NOTE: this is disputed by the Supplier because this is intended behavior for the high-privilege...

1C-Bitrix security vulnerabilities

1C-Bitrix is a website platform system developed by the Russian company 1C-Bitrix. It integrates content management, e-commerce, and enterprise portal functions. Versions of 1C-Bitrix 25.100.500 and earlier contained security vulnerabilities. These vulnerabilities stemmed from users with the RIGH...