Vendor CVEs

Dreamer CMS

All CVEs

23 total · sorted by risk

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2023-42279	Dreamer CMS Dreamer CMS	Cri	0.64	9.8	0.01	Sep 21, 2023	Dreamer CMS v4.1.3 was discovered to contain a SQL injection vulnerability via the model-form-management-field form.
CVE-2023-46886	Dreamer CMS Dreamer CMS	Cri	0.59	9.1	0.01	Nov 29, 2023	Dreamer CMS before version 4.0.1 is vulnerable to Directory Traversal. Background template management allows arbitrary modification of the template file, allowing system sensitive files to be read.
CVE-2023-50017	Dreamer CMS Dreamer CMS	Hig	0.57	8.8	0.00	Dec 14, 2023	Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/database/backup
CVE-2023-48914	Dreamer CMS Dreamer CMS	Hig	0.57	8.8	0.00	Nov 30, 2023	Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/archives/add.
CVE-2023-48913	Dreamer CMS Dreamer CMS	Hig	0.57	8.8	0.00	Nov 30, 2023	Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/archives/delete.
CVE-2023-48912	Dreamer CMS Dreamer CMS	Hig	0.57	8.8	0.00	Nov 30, 2023	Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/archives/edit.
CVE-2023-48021	Dreamer CMS Dreamer CMS	Hig	0.57	8.8	0.00	Nov 14, 2023	Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/task/update.
CVE-2023-48020	Dreamer CMS Dreamer CMS	Hig	0.57	8.8	0.00	Nov 14, 2023	Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/task/changeStatus.
CVE-2023-48060	Dreamer CMS Dreamer CMS	Hig	0.57	8.8	0.00	Nov 13, 2023	Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/task/add
CVE-2023-48058	Dreamer CMS Dreamer CMS	Hig	0.57	8.8	0.00	Nov 13, 2023	Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/task/run
CVE-2023-45907	Dreamer CMS Dreamer CMS	Hig	0.57	8.8	0.00	Oct 17, 2023	Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/variable/delete.
CVE-2023-45904	Dreamer CMS Dreamer CMS	Hig	0.57	8.8	0.00	Oct 17, 2023	Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /variable/update.
CVE-2023-45903	Dreamer CMS Dreamer CMS	Hig	0.57	8.8	0.00	Oct 17, 2023	Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/label/delete.
CVE-2023-45902	Dreamer CMS Dreamer CMS	Hig	0.57	8.8	0.00	Oct 17, 2023	Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/attachment/delete.
CVE-2023-46887	Dreamer CMS Dreamer CMS	Hig	0.49	7.5	0.00	Nov 29, 2023	In Dreamer CMS before 4.0.1, the backend attachment management office has an Arbitrary File Download vulnerability.
CVE-2023-43856	Dreamer CMS Dreamer CMS	Hig	0.49	7.5	0.01	Sep 27, 2023	Dreamer CMS v4.1.3 was discovered to contain an arbitrary file read vulnerability via the component /admin/TemplateController.java.
CVE-2023-7091	Dreamer CMS Dreamer CMS	Med	0.41	6.3	0.01	Dec 24, 2023	A vulnerability was found in Dreamer CMS 4.1.3. It has been declared as problematic. This vulnerability affects unknown code of the file /upload/uploadFile. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The exploit has…
CVE-2023-49484	Dreamer CMS Dreamer CMS	Med	0.35	5.4	0.00	Dec 8, 2023	Dreamer CMS v4.1.3 was discovered to contain a cross-site scripting (XSS) vulnerability in the article management department.
CVE-2023-43857	Dreamer CMS Dreamer CMS	Med	0.35	5.4	0.00	Sep 27, 2023	Dreamer CMS v4.1.3 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the component /admin/u/toIndex.
CVE-2023-29774	Dreamer CMS Dreamer CMS	Med	0.35	5.4	0.00	Apr 18, 2023	Dreamer CMS 3.0.1 is vulnerable to stored Cross Site Scripting (XSS).
CVE-2023-48063	Dreamer CMS Dreamer CMS	Med	0.28	4.3	0.00	Nov 13, 2023	An issue was discovered in dreamer_cms 4.1.3. There is a CSRF vulnerability that can delete a theme project via /admin/category/delete.
CVE-2023-2473	Dreamer CMS Dreamer CMS	Med	0.28	4.3	0.01	May 2, 2023	A vulnerability was found in Dreamer CMS up to 4.1.3. It has been declared as problematic. This vulnerability affects the function updatePwd of the file UserController.java of the component Password Hash Calculation. The manipulation leads to inefficient algorithmic complexity.…
CVE-2023-4743	Dreamer CMS Dreamer CMS	Low	0.20	3.1	0.01	Sep 3, 2023	A vulnerability was found in Dreamer CMS up to 4.1.3. It has been classified as problematic. Affected is an unknown function of the file /upload/ueditorConfig?action=config. The manipulation leads to files or directories accessible. It is possible to launch the attack remotely.…

CVE-2023-42279CriSep 21, 2023
Dreamer CMS
Dreamer CMS
risk 0.64cvss 9.8epss 0.01
Dreamer CMS v4.1.3 was discovered to contain a SQL injection vulnerability via the model-form-management-field form.
CVE-2023-46886CriNov 29, 2023
Dreamer CMS
Dreamer CMS
risk 0.59cvss 9.1epss 0.01
Dreamer CMS before version 4.0.1 is vulnerable to Directory Traversal. Background template management allows arbitrary modification of the template file, allowing system sensitive files to be read.
CVE-2023-50017HigDec 14, 2023
Dreamer CMS
Dreamer CMS
risk 0.57cvss 8.8epss 0.00
Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/database/backup
CVE-2023-48914HigNov 30, 2023
Dreamer CMS
Dreamer CMS
risk 0.57cvss 8.8epss 0.00
Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/archives/add.
CVE-2023-48913HigNov 30, 2023
Dreamer CMS
Dreamer CMS
risk 0.57cvss 8.8epss 0.00
Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/archives/delete.
CVE-2023-48912HigNov 30, 2023
Dreamer CMS
Dreamer CMS
risk 0.57cvss 8.8epss 0.00
Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/archives/edit.
CVE-2023-48021HigNov 14, 2023
Dreamer CMS
Dreamer CMS
risk 0.57cvss 8.8epss 0.00
Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/task/update.
CVE-2023-48020HigNov 14, 2023
Dreamer CMS
Dreamer CMS
risk 0.57cvss 8.8epss 0.00
Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/task/changeStatus.
CVE-2023-48060HigNov 13, 2023
Dreamer CMS
Dreamer CMS
risk 0.57cvss 8.8epss 0.00
Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/task/add
CVE-2023-48058HigNov 13, 2023
Dreamer CMS
Dreamer CMS
risk 0.57cvss 8.8epss 0.00
Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/task/run
CVE-2023-45907HigOct 17, 2023
Dreamer CMS
Dreamer CMS
risk 0.57cvss 8.8epss 0.00
Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/variable/delete.
CVE-2023-45904HigOct 17, 2023
Dreamer CMS
Dreamer CMS
risk 0.57cvss 8.8epss 0.00
Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /variable/update.
CVE-2023-45903HigOct 17, 2023
Dreamer CMS
Dreamer CMS
risk 0.57cvss 8.8epss 0.00
Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/label/delete.
CVE-2023-45902HigOct 17, 2023
Dreamer CMS
Dreamer CMS
risk 0.57cvss 8.8epss 0.00
Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/attachment/delete.
CVE-2023-46887HigNov 29, 2023
Dreamer CMS
Dreamer CMS
risk 0.49cvss 7.5epss 0.00
In Dreamer CMS before 4.0.1, the backend attachment management office has an Arbitrary File Download vulnerability.
CVE-2023-43856HigSep 27, 2023
Dreamer CMS
Dreamer CMS
risk 0.49cvss 7.5epss 0.01
Dreamer CMS v4.1.3 was discovered to contain an arbitrary file read vulnerability via the component /admin/TemplateController.java.
CVE-2023-7091MedDec 24, 2023
Dreamer CMS
Dreamer CMS
risk 0.41cvss 6.3epss 0.01
A vulnerability was found in Dreamer CMS 4.1.3. It has been declared as problematic. This vulnerability affects unknown code of the file /upload/uploadFile. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The exploit has…
CVE-2023-49484MedDec 8, 2023
Dreamer CMS
Dreamer CMS
risk 0.35cvss 5.4epss 0.00
Dreamer CMS v4.1.3 was discovered to contain a cross-site scripting (XSS) vulnerability in the article management department.
CVE-2023-43857MedSep 27, 2023
Dreamer CMS
Dreamer CMS
risk 0.35cvss 5.4epss 0.00
Dreamer CMS v4.1.3 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the component /admin/u/toIndex.
CVE-2023-29774MedApr 18, 2023
Dreamer CMS
Dreamer CMS
risk 0.35cvss 5.4epss 0.00
Dreamer CMS 3.0.1 is vulnerable to stored Cross Site Scripting (XSS).
CVE-2023-48063MedNov 13, 2023
Dreamer CMS
Dreamer CMS
risk 0.28cvss 4.3epss 0.00
An issue was discovered in dreamer_cms 4.1.3. There is a CSRF vulnerability that can delete a theme project via /admin/category/delete.
CVE-2023-2473MedMay 2, 2023
Dreamer CMS
Dreamer CMS
risk 0.28cvss 4.3epss 0.01
A vulnerability was found in Dreamer CMS up to 4.1.3. It has been declared as problematic. This vulnerability affects the function updatePwd of the file UserController.java of the component Password Hash Calculation. The manipulation leads to inefficient algorithmic complexity.…
CVE-2023-4743LowSep 3, 2023
Dreamer CMS
Dreamer CMS
risk 0.20cvss 3.1epss 0.01
A vulnerability was found in Dreamer CMS up to 4.1.3. It has been classified as problematic. Affected is an unknown function of the file /upload/ueditorConfig?action=config. The manipulation leads to files or directories accessible. It is possible to launch the attack remotely.…