CMS
by BandSite
CVEs (6)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2009-4793 | 0.03 | — | 0.02 | Apr 22, 2010 | Unrestricted file upload vulnerability in adminpanel/scripts/addphotos.php in BandSite CMS 1.1.4 allows remote authenticated administrators to execute arbitrary PHP code by uploading a file with an executable extension via an addphotos action to adminpanel/index.php, and then… | |||
| CVE-2009-4792 | 0.03 | — | 0.01 | Apr 22, 2010 | SQL injection vulnerability in includes/content/member_content.php in BandSite CMS 1.1.4 allows remote attackers to execute arbitrary SQL commands via the memid parameter to members.php. | |||
| CVE-2008-7058 | 0.03 | — | 0.01 | Aug 24, 2009 | Cross-site request forgery (CSRF) vulnerability in BandSite CMS 1.1.4 allows remote attackers to hijack the authentication of administrators and force a logout via adminpanel/logout.php. | |||
| CVE-2008-7057 | 0.03 | — | 0.01 | Aug 24, 2009 | Cross-site scripting (XSS) vulnerability in merchandise.php in BandSite CMS 1.1.4 allows remote attackers to inject arbitrary HTML or web script via the type parameter. | |||
| CVE-2008-7056 | 0.03 | — | 0.02 | Aug 24, 2009 | BandSite CMS 1.1.4 does not perform access control for adminpanel/phpmydump.php, which allows remote attackers to obtain copies of the database via a direct request. | |||
| CVE-2008-5497 | 0.03 | — | 0.03 | Dec 12, 2008 | BandSite CMS 1.1.4 allows remote attackers to bypass authentication and gain administrative access by setting the login_auth cookie to true. |
- CVE-2009-4793Apr 22, 2010risk 0.03cvss —epss 0.02
Unrestricted file upload vulnerability in adminpanel/scripts/addphotos.php in BandSite CMS 1.1.4 allows remote authenticated administrators to execute arbitrary PHP code by uploading a file with an executable extension via an addphotos action to adminpanel/index.php, and then…
- CVE-2009-4792Apr 22, 2010risk 0.03cvss —epss 0.01
SQL injection vulnerability in includes/content/member_content.php in BandSite CMS 1.1.4 allows remote attackers to execute arbitrary SQL commands via the memid parameter to members.php.
- CVE-2008-7058Aug 24, 2009risk 0.03cvss —epss 0.01
Cross-site request forgery (CSRF) vulnerability in BandSite CMS 1.1.4 allows remote attackers to hijack the authentication of administrators and force a logout via adminpanel/logout.php.
- CVE-2008-7057Aug 24, 2009risk 0.03cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in merchandise.php in BandSite CMS 1.1.4 allows remote attackers to inject arbitrary HTML or web script via the type parameter.
- CVE-2008-7056Aug 24, 2009risk 0.03cvss —epss 0.02
BandSite CMS 1.1.4 does not perform access control for adminpanel/phpmydump.php, which allows remote attackers to obtain copies of the database via a direct request.
- CVE-2008-5497Dec 12, 2008risk 0.03cvss —epss 0.03
BandSite CMS 1.1.4 allows remote attackers to bypass authentication and gain administrative access by setting the login_auth cookie to true.