Zenario
Source repositories
CVEs (23)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2024-34461 | Cri | 0.57 | 9.8 | 0.01 | May 4, 2024 | Zenario before 9.5.60437 uses Twig filters insecurely in the Twig Snippet plugin, and in the site-wide HEAD and BODY elements, enabling code execution by a designer or an administrator. | ||
| CVE-2022-44136 | Cri | 0.57 | 9.8 | 0.01 | Nov 30, 2022 | Zenario CMS 9.3.57186 is vulnerable to Remote Code Excution (RCE). | ||
| CVE-2018-18420 | Hig | 0.57 | 8.8 | 0.01 | Oct 19, 2018 | Cross-Site Request Forgery (CSRF) vulnerability was discovered in the 8.3 version of Zenario Content Management System via the admin/organizer.ajax.php?path=zenario__content%2Fpanels%2Fcontent URI. | ||
| CVE-2018-5960 | Hig | 0.57 | 8.8 | 0.01 | Jan 22, 2018 | Zenario v7.1 - v7.6 has SQL injection via the `Name` input field of organizer.php or admin_boxes.ajax.php in the `Categories - Edit` module. | ||
| CVE-2021-26830 | Cri | 0.56 | 9.1 | 0.05 | Apr 16, 2021 | SQL Injection in Tribalsystems Zenario CMS 8.8.52729 allows remote attackers to access the database or delete the plugin. This is accomplished via the `ID` input field of ajax.php in the `Pugin library - delete` module. | ||
| CVE-2021-42171 | Hig | 0.40 | 7.2 | 0.03 | Mar 14, 2022 | Zenario CMS 9.0.54156 is vulnerable to File Upload. The web server can be compromised by uploading and executing a web-shell which can run commands, browse system files, browse local resources, attack other servers, and exploit the local vulnerabilities, and so forth. | ||
| CVE-2022-23043 | Hig | 0.40 | 7.2 | 0.01 | Feb 24, 2022 | Zenario CMS 9.2 allows an authenticated admin user to bypass the file upload restriction by creating a new 'File/MIME Types' using the '.phar' extension. Then an attacker can upload a malicious file, intercept the request and change the extension to '.phar' in order to run… | ||
| CVE-2024-34460 | Med | 0.35 | 6.5 | 0.01 | May 4, 2024 | The Tree Explorer tool from Organizer in Zenario before 9.5.60602 is affected by XSS. (This component was removed in 9.5.60602.) | ||
| CVE-2023-44769 | Med | 0.35 | 5.4 | 0.01 | Oct 25, 2023 | A Cross-Site Scripting (XSS) vulnerability in Zenario CMS v.9.4.59197 allows a local attacker to execute arbitrary code via a crafted script to the Spare aliases from Alias. | ||
| CVE-2023-44771 | Med | 0.35 | 5.4 | 0.01 | Oct 6, 2023 | A Cross-Site Scripting (XSS) vulnerability in Zenario CMS v.9.4.59197 allows a local attacker to execute arbitrary code via a crafted script to the Page Layout. | ||
| CVE-2023-44770 | Med | 0.35 | 5.4 | 0.01 | Oct 6, 2023 | A Cross-Site Scripting (XSS) vulnerability in Zenario CMS v.9.4.59197 allows an attacker to execute arbitrary code via a crafted script to the Organizer - Spare alias. | ||
| CVE-2022-44073 | Med | 0.35 | 5.4 | 0.00 | Nov 16, 2022 | Zenario CMS 9.3.57186 is vulnerable to Cross Site Scripting (XSS) via svg,Users & Contacts. | ||
| CVE-2022-44071 | Med | 0.35 | 5.4 | 0.00 | Nov 16, 2022 | Zenario CMS 9.3.57186 is is vulnerable to Cross Site Scripting (XSS) via profile. | ||
| CVE-2022-44070 | Med | 0.35 | 5.4 | 0.00 | Nov 16, 2022 | Zenario CMS 9.3.57186 is vulnerable to Cross Site Scripting (XSS) via News articles. | ||
| CVE-2022-44069 | Med | 0.35 | 5.4 | 0.00 | Nov 16, 2022 | Zenario CMS 9.3.57186 is vulnerable to Cross Site Scripting (XSS) via the Nest library module. | ||
| CVE-2024-45964 | Med | 0.31 | 4.8 | 0.00 | Oct 2, 2024 | Zenario 9.7.61188 is vulnerable to Cross Site Scripting (XSS) in the Image library via the "Organizer tags" field. | ||
| CVE-2024-45960 | Med | 0.31 | 4.8 | 0.00 | Oct 2, 2024 | Zenario 9.7.61188 allows authenticated admin users to upload PDF files containing malicious code into the target system. If the PDF file is accessed through the website, it can trigger a Cross Site Scripting (XSS) attack. | ||
| CVE-2023-39578 | Med | 0.31 | 4.8 | 0.00 | Aug 28, 2023 | A stored cross-site scripting (XSS) vulnerability in the Create function of Zenario CMS v9.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Menu navigation text field. | ||
| CVE-2021-27673 | Med | 0.31 | 4.8 | 0.01 | Apr 15, 2021 | Cross Site Scripting (XSS) in the "admin_boxes.ajax.php" component of Tribal Systems Zenario CMS v8.8.52729 allows remote attackers to execute arbitrary code by injecting arbitrary HTML into the "cID" parameter when creating a new HTML component. | ||
| CVE-2022-4231 | Med | 0.27 | 4.2 | 0.00 | Nov 30, 2022 | A vulnerability, which was classified as problematic, has been found in Tribal Systems Zenario CMS 9.3.57595. This issue affects some unknown processing of the component Remember Me Handler. The manipulation leads to session fixiation. The attack may be initiated remotely. The… |
- risk 0.57cvss 9.8epss 0.01
Zenario before 9.5.60437 uses Twig filters insecurely in the Twig Snippet plugin, and in the site-wide HEAD and BODY elements, enabling code execution by a designer or an administrator.
- risk 0.57cvss 9.8epss 0.01
Zenario CMS 9.3.57186 is vulnerable to Remote Code Excution (RCE).
- risk 0.57cvss 8.8epss 0.01
Cross-Site Request Forgery (CSRF) vulnerability was discovered in the 8.3 version of Zenario Content Management System via the admin/organizer.ajax.php?path=zenario__content%2Fpanels%2Fcontent URI.
- risk 0.57cvss 8.8epss 0.01
Zenario v7.1 - v7.6 has SQL injection via the `Name` input field of organizer.php or admin_boxes.ajax.php in the `Categories - Edit` module.
- risk 0.56cvss 9.1epss 0.05
SQL Injection in Tribalsystems Zenario CMS 8.8.52729 allows remote attackers to access the database or delete the plugin. This is accomplished via the `ID` input field of ajax.php in the `Pugin library - delete` module.
- risk 0.40cvss 7.2epss 0.03
Zenario CMS 9.0.54156 is vulnerable to File Upload. The web server can be compromised by uploading and executing a web-shell which can run commands, browse system files, browse local resources, attack other servers, and exploit the local vulnerabilities, and so forth.
- risk 0.40cvss 7.2epss 0.01
Zenario CMS 9.2 allows an authenticated admin user to bypass the file upload restriction by creating a new 'File/MIME Types' using the '.phar' extension. Then an attacker can upload a malicious file, intercept the request and change the extension to '.phar' in order to run…
- risk 0.35cvss 6.5epss 0.01
The Tree Explorer tool from Organizer in Zenario before 9.5.60602 is affected by XSS. (This component was removed in 9.5.60602.)
- risk 0.35cvss 5.4epss 0.01
A Cross-Site Scripting (XSS) vulnerability in Zenario CMS v.9.4.59197 allows a local attacker to execute arbitrary code via a crafted script to the Spare aliases from Alias.
- risk 0.35cvss 5.4epss 0.01
A Cross-Site Scripting (XSS) vulnerability in Zenario CMS v.9.4.59197 allows a local attacker to execute arbitrary code via a crafted script to the Page Layout.
- risk 0.35cvss 5.4epss 0.01
A Cross-Site Scripting (XSS) vulnerability in Zenario CMS v.9.4.59197 allows an attacker to execute arbitrary code via a crafted script to the Organizer - Spare alias.
- risk 0.35cvss 5.4epss 0.00
Zenario CMS 9.3.57186 is vulnerable to Cross Site Scripting (XSS) via svg,Users & Contacts.
- risk 0.35cvss 5.4epss 0.00
Zenario CMS 9.3.57186 is is vulnerable to Cross Site Scripting (XSS) via profile.
- risk 0.35cvss 5.4epss 0.00
Zenario CMS 9.3.57186 is vulnerable to Cross Site Scripting (XSS) via News articles.
- risk 0.35cvss 5.4epss 0.00
Zenario CMS 9.3.57186 is vulnerable to Cross Site Scripting (XSS) via the Nest library module.
- risk 0.31cvss 4.8epss 0.00
Zenario 9.7.61188 is vulnerable to Cross Site Scripting (XSS) in the Image library via the "Organizer tags" field.
- risk 0.31cvss 4.8epss 0.00
Zenario 9.7.61188 allows authenticated admin users to upload PDF files containing malicious code into the target system. If the PDF file is accessed through the website, it can trigger a Cross Site Scripting (XSS) attack.
- risk 0.31cvss 4.8epss 0.00
A stored cross-site scripting (XSS) vulnerability in the Create function of Zenario CMS v9.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Menu navigation text field.
- risk 0.31cvss 4.8epss 0.01
Cross Site Scripting (XSS) in the "admin_boxes.ajax.php" component of Tribal Systems Zenario CMS v8.8.52729 allows remote attackers to execute arbitrary code by injecting arbitrary HTML into the "cID" parameter when creating a new HTML component.
- risk 0.27cvss 4.2epss 0.00
A vulnerability, which was classified as problematic, has been found in Tribal Systems Zenario CMS 9.3.57595. This issue affects some unknown processing of the component Remember Me Handler. The manipulation leads to session fixiation. The attack may be initiated remotely. The…
Page 1 of 2