Vulnerabilities
7 CVEs · NVD, GitHub Advisories, CISA KEV, FIRST EPSS, GitHub PoC repos
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2022-29725 | An arbitrary file upload in the image upload component of wityCMS v0.6.2 allows attackers to execute arbitrary code via a crafted PHP file. An arbitrary file upload in the image upload component of wityCMS v0.6.2 allows attackers to execute arbitrary code via a crafted PHP file. NVD description · AI analysis pending | 8.8 | 1% | PoC |
| — | |
| CVE-2018-16250 +1 in the same advisory: …16251 | The "utilisateur" menu in Creatiwity wityCMS 0.6.2 modifies the presence of XSS at two input points for user information, with the "first name" and "last name" The "utilisateur" menu in Creatiwity wityCMS 0.6.2 modifies the presence of XSS at two input points for user information, with the "first name" and "last name" parameters. NVD description · AI analysis pending | 5.4 group max | <1% | PoC |
| — | |
| CVE-2018-16776 | wityCMS 0.6.2 has XSS via the "Site Name" field found in the "Contact" "Configuration" page. wityCMS 0.6.2 has XSS via the "Site Name" field found in the "Contact" "Configuration" page. NVD description · AI analysis pending | 4.8 | <1% | PoC |
| — | |
| CVE-2018-14029 | CSRF vulnerability in admin/user/edit in Creatiwity wityCMS 0.6.2 allows an attacker to take over a user account, as demonstrated by modifying the account's ema CSRF vulnerability in admin/user/edit in Creatiwity wityCMS 0.6.2 allows an attacker to take over a user account, as demonstrated by modifying the account's email field. NVD description · AI analysis pending | 8.8 | 3% | PoC ×2 |
| — | |
| CVE-2018-12065 | A Local File Inclusion vulnerability in /system/WCore/WHelper.php in Creatiwity wityCMS 0.6.2 allows remote attackers to include local PHP files (execute PHP co A Local File Inclusion vulnerability in /system/WCore/WHelper.php in Creatiwity wityCMS 0.6.2 allows remote attackers to include local PHP files (execute PHP code) or read non-PHP files by replacing a helper.json file. NVD description · AI analysis pending | 9.8 | 3% | PoC |
| — | |
| CVE-2018-11512 | Stored cross-site scripting (XSS) vulnerability in the "Website's name" field found in the "Settings" page under the "General" menu in Creatiwity wityCMS 0.6.1 Stored cross-site scripting (XSS) vulnerability in the "Website's name" field found in the "Settings" page under the "General" menu in Creatiwity wityCMS 0.6.1 allows remote attackers to inject arbitrary web script or HTML via a crafted website name by doing an authenticated POST HTTP request to admin/settings/general. NVD description · AI analysis pending | 4.8 | 2% | PoC ×2 |
| — |