CVE-2024-24399

CVE-2024-24399 affects LEPTON v7.0.0: an arbitrary file upload vulnerability allows an authenticated attacker to upload PHP code via the backend/languages/index.php languages area, enabling execution of arbitrary code with high impact (C/H, I/H, A/H per CVSS). The Connected documents corroborate ...

CVE-2020-12705

LeptonCMS is affected by multiple cross-site scripting (XSS) vulnerabilities in versions before 4.6.0. The root cause is inadequate validation of client-side data by the web application, enabling attackers to inject and execute code in a user’s browser. Impact described in the sources includes th...

CVE-2024-29514

The content management system LeptonCMS (version v.7.1.0 ) is vulnerable to a File Upload flaw. This vulnerability allows a remote authenticated attacker to execute arbitrary code by uploading a crafted PHP file . To mitigate this risk, it is recommended to disable file upload functionality until...

CVE-2020-29240

CVE-2020-29240 concerns Lepton-CMS 4.7.0, where a cross-site scripting (XSS) vulnerability exists in the admin UI. The vulnerability allows an attacker to inject an XSS payload via the URL field accessed from the Menu-Pages-Pages Overview section; every time an admin visits that page, the payload...

CVE-2024-29515

A File Upload vulnerability exists in lepton v.7.1.0 (LeptonCMS), a content management system. A remote authenticated attacker can execute arbitrary code by uploading a crafted PHP file to the save.php and config.php components. This flaw could allow an attacker to potentially gain control over t...

CVE-2025-56704

LeptonCMS 7.3.0 is affected by an arbitrary file upload vulnerability caused by insufficient validation of uploaded files. An authenticated attacker can upload a crafted ZIP/PHP file to execute arbitrary code. Affected software: LeptonCMS 7.3.0. Root cause: lack of proper validation during file u...

CVE-2024-24520

An issue in Lepton CMS v.7.0.0 allows a local attacker to execute arbitrary code via the upgrade.php file located in the languages directory. This vulnerability is categorized as Improper Control of Generation of Code . As a temporary workaround, it is recommended to restrict access to the upgrad...

CVE-2020-24872

CVE-2020-24872 is a cross-site scripting vulnerability in Lepton-CMS 4.7.0, stemming from lack of proper filtering/escaping in backend/pages/modify.php. The issue allows remote attackers to inject and execute arbitrary web scripts or HTML when a user views or submits crafted data, with the CVSS i...