Croogo
Products
1- 14 CVEs
Recent CVEs
14| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2021-44673 | Hig | 0.61 | 8.8 | 0.09 | Mar 10, 2022 | A Remote Code Execution (RCE) vulnerability exists in Croogo 3.0.2via admin/file-manager/attachments, which lets a malicoius user upload a web shell script. | ||
| CVE-2024-29643 | Cri | 0.59 | 9.1 | 0.01 | Apr 18, 2025 | An issue in croogo v.3.0.2 allows an attacker to perform Host header injection via the feed.rss component. | ||
| CVE-2024-42718 | Med | 0.42 | 6.5 | 0.01 | Dec 26, 2025 | A path traversal vulnerability in Croogo CMS 4.0.7 allows remote attackers to read arbitrary files via a specially crafted path in the 'edit-file' parameter. | ||
| CVE-2017-1000510 | Med | 0.35 | 5.4 | 0.01 | Feb 9, 2018 | Croogo version 2.3.1-17-g6f82e6c contains a Cross Site Scripting (XSS) vulnerability in Page name that can result in execution of javascript code. | ||
| CVE-2024-6647 | Med | 0.31 | 4.7 | 0.00 | Jul 10, 2024 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical has been found in Croogo up to 4.0.7. This affects an unknown part of the file admin/settings/settings/prefix/Theme of the component Setting Handler. The manipulation of the argument Content-Type leads to… | ||
| CVE-2019-20789 | Med | 0.31 | 4.8 | 0.01 | Apr 26, 2020 | Croogo before 3.0.7 allows XSS via the title to admin/menus/menus or admin/taxonomy/vocabularies. | ||
| CVE-2019-7173 | Med | 0.24 | 4.8 | 0.01 | Jan 29, 2019 | A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /admin/file-manager/attachments/edit/4. | ||
| CVE-2019-7171 | Med | 0.24 | 4.8 | 0.01 | Jan 29, 2019 | A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /admin/blocks/blocks/edit/8. | ||
| CVE-2019-7170 | Med | 0.24 | 4.8 | 0.01 | Jan 29, 2019 | A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /admin/taxonomy/vocabularies. | ||
| CVE-2019-7169 | Med | 0.24 | 4.8 | 0.01 | Jan 29, 2019 | A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /admin/menus/menus/edit/3. | ||
| CVE-2019-7168 | Med | 0.24 | 4.8 | 0.01 | Jan 29, 2019 | A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Blog field to /admin/nodes/nodes/add/blog. | ||
| CVE-2014-8577 | 0.03 | — | 0.04 | Oct 31, 2014 | Multiple cross-site scripting (XSS) vulnerabilities in Croogo before 2.1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) data[Contact][title] parameter to admin/contacts/contacts/add page; (2) data[Block][title] or (3) data[Block][alias] parameter to… | |||
| CVE-2026-16219 | Med | 0.00 | 6.3 | 0.00 | Jul 19, 2026 | A flaw has been found in Croogo CMS up to 4.0.7. This affects the function FileManager::isEditable of the file FileManager/src/Utility/FileManager.php of the component Admin File Manager. This manipulation causes path traversal. The attack can be initiated remotely. The exploit… | ||
| CVE-2015-1053 | 0.00 | — | 0.02 | Jan 16, 2015 | Cross-site scripting (XSS) vulnerability in the administrative backend in Croogo before 2.2.1 allows remote attackers to inject arbitrary web script or HTML via the path parameter to admin/file_manager/file_manager/editfile. |
- risk 0.61cvss 8.8epss 0.09
A Remote Code Execution (RCE) vulnerability exists in Croogo 3.0.2via admin/file-manager/attachments, which lets a malicoius user upload a web shell script.
- risk 0.59cvss 9.1epss 0.01
An issue in croogo v.3.0.2 allows an attacker to perform Host header injection via the feed.rss component.
- risk 0.42cvss 6.5epss 0.01
A path traversal vulnerability in Croogo CMS 4.0.7 allows remote attackers to read arbitrary files via a specially crafted path in the 'edit-file' parameter.
- risk 0.35cvss 5.4epss 0.01
Croogo version 2.3.1-17-g6f82e6c contains a Cross Site Scripting (XSS) vulnerability in Page name that can result in execution of javascript code.
- risk 0.31cvss 4.7epss 0.00
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical has been found in Croogo up to 4.0.7. This affects an unknown part of the file admin/settings/settings/prefix/Theme of the component Setting Handler. The manipulation of the argument Content-Type leads to…
- risk 0.31cvss 4.8epss 0.01
Croogo before 3.0.7 allows XSS via the title to admin/menus/menus or admin/taxonomy/vocabularies.
- risk 0.24cvss 4.8epss 0.01
A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /admin/file-manager/attachments/edit/4.
- risk 0.24cvss 4.8epss 0.01
A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /admin/blocks/blocks/edit/8.
- risk 0.24cvss 4.8epss 0.01
A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /admin/taxonomy/vocabularies.
- risk 0.24cvss 4.8epss 0.01
A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /admin/menus/menus/edit/3.
- risk 0.24cvss 4.8epss 0.01
A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Blog field to /admin/nodes/nodes/add/blog.
- CVE-2014-8577Oct 31, 2014risk 0.03cvss —epss 0.04
Multiple cross-site scripting (XSS) vulnerabilities in Croogo before 2.1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) data[Contact][title] parameter to admin/contacts/contacts/add page; (2) data[Block][title] or (3) data[Block][alias] parameter to…
- risk 0.00cvss 6.3epss 0.00
A flaw has been found in Croogo CMS up to 4.0.7. This affects the function FileManager::isEditable of the file FileManager/src/Utility/FileManager.php of the component Admin File Manager. This manipulation causes path traversal. The attack can be initiated remotely. The exploit…
- CVE-2015-1053Jan 16, 2015risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in the administrative backend in Croogo before 2.2.1 allows remote attackers to inject arbitrary web script or HTML via the path parameter to admin/file_manager/file_manager/editfile.