CVE-2024-24399

CVE-2024-24399 affects LEPTON v7.0.0: an arbitrary file upload vulnerability allows an authenticated attacker to upload PHP code via the backend/languages/index.php languages area, enabling execution of arbitrary code with high impact (C/H, I/H, A/H per CVSS). The Connected documents corroborate ...

CVE-2020-12705

LeptonCMS is affected by multiple cross-site scripting (XSS) vulnerabilities in versions before 4.6.0. The root cause is inadequate validation of client-side data by the web application, enabling attackers to inject and execute code in a user’s browser. Impact described in the sources includes th...

CVE-2024-29514

The content management system LeptonCMS (specifically lepton version 7.1.0 ) is susceptible to a File Upload vulnerability . This flaw allows a remote authenticated attacker to achieve arbitrary code execution by uploading a crafted PHP file . To mitigate this risk, it is recommended to disable f...

CVE-2020-29240

CVE-2020-29240 concerns Lepton-CMS 4.7.0, where a cross-site scripting (XSS) vulnerability exists in the admin UI. The vulnerability allows an attacker to inject an XSS payload via the URL field accessed from the Menu-Pages-Pages Overview section; every time an admin visits that page, the payload...

CVE-2024-29515

LeptonCMS version v.7.1.0 is susceptible to a file upload vulnerability that allows a remote authenticated attacker to achieve arbitrary code execution . The root cause involves the ability to upload specially crafted PHP files to the save.php and config.php components, potentially granting the a...

CVE-2024-24520

An issue in Lepton CMS v.7.0.0 allows a local attacker to execute arbitrary code via the upgrade.php file located in the languages place. While there is currently no information regarding a patched version, a temporary workaround is to restrict access to the upgrade.php file. The provided documen...

CVE-2020-24872

CVE-2020-24872 is a cross-site scripting vulnerability in Lepton-CMS 4.7.0, stemming from lack of proper filtering/escaping in backend/pages/modify.php. The issue allows remote attackers to inject and execute arbitrary web scripts or HTML when a user views or submits crafted data, with the CVSS i...

CVE-2025-56704

LeptonCMS 7.3.0 is affected by an arbitrary file upload vulnerability caused by insufficient validation of uploaded files. An authenticated attacker can upload a crafted ZIP/PHP file to execute arbitrary code. Affected software: LeptonCMS 7.3.0. Root cause: lack of proper validation during file u...