Empirecms Security Vulnerabilities and Issues — Empirecms CVE List

Lucene search

PhomeEmpirecms

6 matches found

CVE•added 2018/02/12 3:29 a.m.•47 views

CVE-2018-6880

EmpireCMS 6.6 through 7.2 allows remote attackers to discover the full path via an array value for a parameter to class/connect.php.

5.3CVSS5.3AI score0.00333EPSS

CVE•added 2018/02/12 3:29 a.m.•44 views

CVE-2018-6881

EmpireCMS 6.6 allows remote attackers to discover the full path via an array value for a parameter to admin/tool/ShowPic.php.

5.3CVSS5.3AI score0.00494EPSS

CVE•added 2018/09/02 6:29 p.m.•33 views

CVE-2018-16339

An issue was discovered in EmpireCMS 7.0. There is a CSRF vulnerability that can add administrators via upload/e/admin/user/AddUser.php?enews=AddUser.

8.8CVSS8.6AI score0.00141EPSS

CVE•added 2018/10/31 6:29 a.m.•32 views

CVE-2018-18869

EmpireCMS V7.5 allows remote attackers to upload and execute arbitrary code via ..%2F directory traversal in a .php filename in the upload/e/admin/ecmscom.php path parameter.

9.8CVSS9.6AI score0.03845EPSS

CVE•added 2018/10/09 8:29 p.m.•29 views

CVE-2018-18086

EmpireCMS v7.5 has an arbitrary file upload vulnerability in the LoadInMod function in e/class/moddofun.php, exploitable by logged-in users.

8.8CVSS8.7AI score0.00401EPSS

CVE•added 2018/12/20 12:29 a.m.•28 views

CVE-2018-20300

Empire CMS 7.5 allows remote attackers to execute arbitrary PHP code via the ftemp parameter in an enews=EditMemberForm action because this code is injected into a memberform.$fid.php file.

9.8CVSS9.7AI score0.00994EPSS