PT-2015-4303

Name of the Vulnerable Software and Affected Versions b2evolution versions prior to 5.2.1 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is achieved via the fm filter parameter to the "blogs/admin.php" API endpoint...

CVE-2014-9599: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the filemanager in b2evolution before 5.2.1 allows remote attackers to inject arbitrary web script or HTML via the fmfilter parameter to blogs/admin.php...

PT-2014-2641

Name of the Vulnerable Software and Affected Versions b2evolution versions prior to 4.1.7 Description The issue allows remote authenticated administrators to execute arbitrary SQL commands via the show statuses parameter in the "blogs/admin.php" endpoint. This can be leveraged using CSRF to enabl...

PT-2014-3385

Name of the Vulnerable Software and Affected Versions b2evolution versions prior to 4.1.7 Description A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of administrators for requests that conduct SQL injection attacks via the show statuses parameter...

CVE-2013-7352: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in blogs/admin.php in b2evolution before 4.1.7 allows remote attackers to hijack the authentication of administrators for requests that conduct SQL injection attacks via the showstatuses parameter, related to CVE-2013-2945...

CVE-2013-2945: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in blogs/admin.php in b2evolution before 4.1.7 allows remote authenticated administrators to execute arbitrary SQL commands via the showstatuses parameter. NOTE: this can be leveraged using CSRF to allow remote unauthenticated attackers to execute arbitrary SQL command...