Lucene search

Kreasfero Security Vulnerabilities - February

cve

CVE-2021-42675

Kreado Kreasfero 1.5 does not properly sanitize uploaded files to the media directory. One can upload a malicious PHP file and obtain remote code execution.

9.8CVSS

9.8AI Score

0.018EPSS

2022-06-14 05:15 PM

cve

CVE-2021-44581

An SQL Injection vulnerabilty exists in Kreado Kreasfero 1.5 via the id parameter.

7.5CVSS

8AI Score

0.001EPSS

2022-03-29 01:15 AM