CVE-2021-44238

AyaCMS 3.1.2 is vulnerable to Remote Code Execution via /aya/module/admin/ust_tab_e.inc.php. The underlying issue is improper filtering of certain elements on that admin page, leading to RCE. Attack vector is network and no user interaction required per CVSS 3.1 (base score 7.2, HIGH). No explici...

CVE-2022-48116

AyaCMS v3.1.2 is affected by a remote code execution (RCE) vulnerability in the /admin/tpl_edit.inc.php component. The issue is confirmed across multiple sources (NVD, Red Hat, CNNVD, CVE list, etc.). The CVE-entry describes an RCE with high impact (C/H/I/A) and network attack vector, without use...

CVE-2022-45548

CVE-2022-45548 affects AyaCMS v3.1.2 with an Arbitrary File Upload vulnerability. CVSS v3.1 base score 8.8 (HIGH) indicates network access, low attack complexity, and requires low privileges with no user interaction; impact to confidentiality, integrity, and availability is HIGH. The connected do...

CVE-2022-47926

AyaCMS 3.1.2 is vulnerable to file deletion via /aya/module/admin/fst_del.inc.php. Affected component: AyaCMS (PHP web app). Root cause: endpoint allows deletion of files; impact is high (potential loss/overwrite of files). Exploitation status is not detailed in the provided documents. Remediatio...

CVE-2022-46101

AyaCMS v3.1.2 has a code flaw in ust_sql.inc.php that enables command execution via injected code. The vulnerability is described across multiple sources (e.g., Red Hat, CVE records, and PT-Security) with a CVSS v3.1 base score of 8.8 (HIGH) and an attack vector of NETWORK, requiring LOW privileg...

CVE-2022-45550

CVE-2022-45550 affects AyaCMS 3.1.2 and is described as a Remote Code Execution (RCE) vulnerability. The NVD/CVSS data show a high-severity impact (CVSS v3.1: 9.8, Network attack vector, no user interaction required, high confidentiality/integrity/availability impact). The provided documents do n...

CVE-2022-46102

AyaCMS 3.1.2 is vulnerable to arbitrary file upload via /aya/module/admin/fst_down.inc.php. The provided documents identify the vulnerable endpoint but do not disclose the exact root cause, affected components beyond the path, or concrete remediation details. The CVSS metrics in the primary entry...

CVE-2022-43074

CVE-2022-43074 affects AyaCMS v3.1.2 with an arbitrary file upload vulnerability in the /admin/fst_upload.inc.php component. The issue permits execution of arbitrary code via a crafted PHP file, per the primary CVE description. The associated metrics indicate a 9.8 base score (CRITICAL) under CVS...

CVE-2020-23686

CVE-2020-23686 affects AyaCMS 3.1.2 and is a Cross-Site Request Forgery (CSRF) flaw stemming from the software’s lack of CSRF protection during administrator password changes, enabling an attacker to change the admin password (and potentially other impacts) as described in multiple security recor...