CVE-2022-28445

CVE-2022-28445 affects KiteCMS v1.1.1 and describes an arbitrary file read vulnerability in the background management module. The issue exposes partial confidentiality (per CVSS v3.1: HIGH confidentiality impact, network attack vector, low attack complexity, no user interaction) but no explicit e...

CVE-2021-31707

CVE-2021-31707 affects KiteCMS. A permissions issue in the upload file type allows a remote attacker to execute arbitrary code. The vulnerability is characterized by a high-severity CVSS v3.1 score (9.8, CRITICAL) with network access, no privileges required, and no user interaction needed, and it...

CVE-2021-31731

KiteCMS 1.1.1 is affected by a directory traversal vulnerability reachable via ../ in the path parameter to index.php/admin/Template/fileedit, which can allow remote administrators to overwrite arbitrary files and place PHP code via the html parameter. This is corroborated by multiple sources in ...

CVE-2020-20521

CVE-2020-20521 is a Cross Site Scripting vulnerability in KiteCMS v1.1 that enables a remote attacker to execute arbitrary code via the comment parameter. The CVSS v3.1 base score is 6.1 (Medium); attack vector Network, user interaction Required, with a Changed scope and Confidentiality/Integrity...

CVE-2020-20522

CVE-2020-20522 affects KiteCMS v1.1. The vulnerability is described as a Cross Site Scripting issue that allows a remote attacker to execute arbitrary code via the registering user parameter. Public sources across multiple feeds corroborate the same description. The connected documents do not pro...

CVE-2021-36546

KiteCMS 1.1 is affected by an Incorrect Access Control issue that lets remote attackers view sensitive information by manipulating the path in the application URL. The vulnerability impacts confidentiality (C:H) with no listed impact on integrity or availability in the provided documents. The CVE...

CVE-2021-3267

CVE-2021-3267 relates to KiteCMS v1.1 where a flaw in the uploadFile function allows a remote attacker to execute arbitrary code. The issue is confirmed across multiple reputable sources in the connected set, all describing a file-upload vulnerability that enables code execution. Practical impact...

CVE-2020-20671

CVE-2020-20671 describes a cross-site request forgery (CSRF) in KiteCMS v1.1 that allows an attacker to arbitrarily add an administrator account. The connected records confirm the affected product/version and the attack class, but do not provide technical details beyond the CSRF vulnerability and...

CVE-2020-20672

KiteCMS v1.1 contains an arbitrary file upload vulnerability in /admin/upload/uploadfile that allows an attacker to getshell by uploading a crafted PHP file. Multiple sources (NVD/CVE, CNVD, Red Hat advisories, OSV, CVE lists) corroborate the flaw as an arbitrary file upload in KiteCMS with impac...