Known Vulnerabilities for products from Thinkcmf
Listed below are 14 of the newest known vulnerabilities associated with the vendor "Thinkcmf".
These CVEs are retrieved based on exact matches on listed vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed vendor information are still displayed.
Data on known vulnerable products is also displayed based on information from known CPEs, each product links to its respective vulnerability page.
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2022-40849 json | ThinkCMF version 6.0.7 is affected by Stored Cross-Site Scripting (XSS). An attacker who successfully exploited this vulnerab... | 5.4 - MEDIUM | 2022-12-01 | 2022-12-02 |
| CVE-2022-40489 json | ThinkCMF version 6.0.7 is affected by a Cross Site Request Forgery (CSRF) vulnerability that allows a Super Administrator use... | 8.8 - HIGH | 2022-12-01 | 2022-12-02 |
| CVE-2021-40616 json | ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new secur... | 6.5 - MEDIUM | 2022-06-14 | 2023-08-08 |
| CVE-2020-25915 json | ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new secur... | 5.4 - MEDIUM | 2023-08-11 | 2023-08-16 |
| CVE-2020-20601 json | An issue in ThinkCMF X2.2.2 and below allows attackers to execute arbitrary code via a crafted packet. | 9.8 - CRITICAL | 2021-12-22 | 2022-07-12 |
| CVE-2020-18151 json | Cross Site Request Forgerly (CSRF) vulnerability in ThinkCMF v5.1.0, which can add an admin account. | 6.5 - MEDIUM | 2021-07-14 | 2022-10-28 |
| CVE-2019-7580 json | ThinkCMF 5.0.190111 allows remote attackers to execute arbitrary PHP code via the portal/admin_category/addpost.html alias pa... | 8.8 - HIGH | 2019-02-07 | 2019-02-08 |
| CVE-2019-6713 json | app\admin\controller\RouteController.php in ThinkCMF 5.0.190111 allows remote attackers to execute arbitrary PHP code by usin... | 9.8 - CRITICAL | 2019-01-23 | 2019-04-12 |
| CVE-2018-19898 json | ThinkCMF X2.2.2 has SQL Injection via the method edit_post in ArticleController.class.php and is exploitable by normal authen... | 8.8 - HIGH | 2018-12-06 | 2018-12-26 |
| CVE-2018-19897 json | ThinkCMF X2.2.2 has SQL Injection via the function _listorders() in AdminbaseController.class.php and is exploitable with the... | 7.2 - HIGH | 2018-12-06 | 2018-12-26 |
| CVE-2018-19896 json | ThinkCMF X2.2.2 has SQL Injection via the function delete() in SlideController.class.php and is exploitable with the manager ... | 7.2 - HIGH | 2018-12-06 | 2018-12-26 |
| CVE-2018-19895 json | ThinkCMF X2.2.2 has SQL Injection via the function edit_post() in NavController.class.php and is exploitable with the manager... | 7.2 - HIGH | 2018-12-06 | 2018-12-26 |
| CVE-2018-19894 json | ThinkCMF X2.2.2 has SQL Injection via the functions check() and delete() in CommentadminController.class.php and is exploitab... | 7.2 - HIGH | 2018-12-06 | 2018-12-26 |
| CVE-2018-16141 json | ThinkCMF X2.2.3 has an arbitrary file deletion vulnerability in do_avatar in \application\User\Controller\ProfileController.c... | 6.5 - MEDIUM | 2018-08-30 | 2018-11-06 |