Known Vulnerabilities for products from Gilacms
Listed below are 20 of the newest known vulnerabilities associated with the vendor "Gilacms".
These CVEs are retrieved based on exact matches on listed vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed vendor information are still displayed.
Data on known vulnerable products is also displayed based on information from known CPEs, each product links to its respective vulnerability page.
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2021-39486 json | A Stored XSS via Malicious File Upload exists in Gila CMS version 2.2.0. An attacker can use this to steal cookies, passwords... | 5.4 - MEDIUM | 2021-10-04 | 2021-10-12 |
| CVE-2021-37777 json | Gila CMS 2.2.0 is vulnerable to Insecure Direct Object Reference (IDOR). Thumbnails uploaded by one site owner are visible by... | 7.5 - HIGH | 2021-10-04 | 2022-05-03 |
| CVE-2020-28692 json | In Gila CMS 1.16.0, an attacker can upload a shell to tmp directy and abuse .htaccess through the logs function for executing... | 7.2 - HIGH | 2020-11-16 | 2020-11-30 |
| CVE-2020-26625 json | A SQL injection vulnerability was discovered in Gila CMS 1.15.4 and earlier which allows a remote attacker to execute arbitra... | Not Provided | 2024-01-02 | 2026-07-05 |
| CVE-2020-26624 json | A SQL injection vulnerability was discovered in Gila CMS 1.15.4 and earlier which allows a remote attacker to execute arbitra... | Not Provided | 2024-01-02 | 2026-07-05 |
| CVE-2020-26623 json | SQL Injection vulnerability discovered in Gila CMS 1.15.4 and earlier allows a remote attacker to execute arbitrary web scrip... | Not Provided | 2024-01-02 | 2026-07-05 |
| CVE-2020-20726 json | ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new secur... | 8.8 - HIGH | 2023-06-20 | 2023-06-27 |
| CVE-2020-20696 json | A cross-site scripting (XSS) vulnerability in /admin/content/post of GilaCMS v1.11.4 allows attackers to execute arbitrary we... | 5.4 - MEDIUM | 2021-09-27 | 2021-10-01 |
| CVE-2020-20695 json | A stored cross-site scripting (XSS) vulnerability in GilaCMS v1.11.4 allows attackers to execute arbitrary web scripts or HTM... | 5.4 - MEDIUM | 2021-09-27 | 2021-10-01 |
| CVE-2020-20693 json | A Cross-Site Request Forgery (CSRF) in GilaCMS v1.11.4 allows authenticated attackers to arbitrarily add administrator accoun... | 8.8 - HIGH | 2021-09-27 | 2021-10-01 |
| CVE-2020-20692 json | GilaCMS v1.11.4 was discovered to contain a SQL injection vulnerability via the $_GET parameter in /src/core/controllers/cm.p... | 7.2 - HIGH | 2021-09-27 | 2021-10-01 |
| CVE-2020-20523 json | ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new secur... | 6.1 - MEDIUM | 2023-08-11 | 2023-08-16 |
| CVE-2020-5515 json | Gila CMS 1.11.8 allows /admin/sql?query= SQL Injection. | 7.2 - HIGH | 2020-01-06 | 2022-09-30 |
| CVE-2020-5514 json | Gila CMS 1.11.8 allows Unrestricted Upload of a File with a Dangerous Type via .phar or .phtml to the lzld/thumb?src= URI. | 9.1 - CRITICAL | 2020-01-06 | 2020-01-09 |
| CVE-2020-5513 json | Gila CMS 1.11.8 allows /cm/delete?t=../ Directory Traversal. | 6.8 - MEDIUM | 2020-01-06 | 2020-01-08 |
| CVE-2020-5512 json | Gila CMS 1.11.8 allows /admin/media?path=../ Path Traversal. | 6.8 - MEDIUM | 2020-01-06 | 2020-01-08 |
| CVE-2019-20804 json | Gila CMS before 1.11.6 allows CSRF with resultant XSS via the admin/themes URI, leading to compromise of the admin account. | 8.8 - HIGH | 2020-05-21 | 2022-10-06 |
| CVE-2019-20803 json | Gila CMS before 1.11.6 has reflected XSS via the admin/content/postcategory id parameter, which is mishandled for g_preview_t... | 6.1 - MEDIUM | 2020-05-21 | 2022-10-06 |
| CVE-2019-17536 json | Gila CMS through 1.11.4 allows Unrestricted Upload of a File with a Dangerous Type via the moveAction function in core/contro... | 4.9 - MEDIUM | 2019-10-13 | 2019-10-17 |
| CVE-2019-17535 json | Gila CMS through 1.11.4 allows blog-list.php XSS, in both the gila-blog and gila-mag themes, via the search parameter, a rela... | 6.1 - MEDIUM | 2019-10-13 | 2019-10-16 |
Known software with vulnerabilities from Gilacms
| Type | Vendor | Product | Version |
|---|---|---|---|
| Application | Gilacms | Gila Cms | 0.1 |