PT-2023-14430 · Unknown · B2Evolution

Name of the Vulnerable Software and Affected Versions: b2evolution version 7.2.5 Description: The issue allows for arbitrary file upload, leading to command execution, when configured with admins can manipulate sensitive files. This is considered a feature by the vendor, but it can be exploited b...

Design/Logic Flaw

b2evolution 6.7.6 suffer from an Object Injection vulnerability in /htsrv/callplugin.php...

CVE-2017-5539

CVE-2017-5539 relates to a bypass of the directory-traversal patch for b2evolution 6.8.4-stable, allowing an attacker to use ../ to bypass filters and read/delete arbitrary server files or check file existence. Affected product: b2evolution (PHP/MySQL blogging software). Root cause: incomplete fi...

CVE-2011-3709

b2evolution 3.3.3 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by locales/ruRU/ru-RU.locale.php and certain other files...