) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.
Search Results (Refine Search)
- CPE Product Version: cpe:/a:bigtreecms:bigtree_cms:4.0:b3
| Vuln ID | Summary | CVSS Severity |
|---|---|---|
| CVE-2013-5313 |
Cross-site request forgery (CSRF) vulnerability in core/admin/modules/users/update.php in BigTree CMS 4.0 RC2 and earlier allows remote attackers to hijack the authentication of administrators for requests that modify arbitrary user accounts via an edit user action. Published: August 19, 2013; 5:10:49 PM -0400 |
V3.x:(not available) V2.0: 6.8 MEDIUM |
| CVE-2013-4881 |
Cross-site request forgery (CSRF) vulnerability in core/admin/modules/users/create.php in BigTree CMS 4.0 RC2 and earlier allows remote attackers to hijack the authentication of administrators for requests that create an administrative user via an add user action to index.php. Published: August 19, 2013; 9:07:58 AM -0400 |
V3.x:(not available) V2.0: 6.8 MEDIUM |
| CVE-2013-4880 |
Cross-site scripting (XSS) vulnerability in core/admin/modules/developer/modules/views/add.php in BigTree CMS 4.0 RC2 and earlier allows remote attackers to inject arbitrary web script or HTML via the module parameter. Published: August 14, 2013; 9:50:00 AM -0400 |
V3.x:(not available) V2.0: 4.3 MEDIUM |
| CVE-2013-4879 |
SQL injection vulnerability in core/inc/bigtree/cms.php in BigTree CMS 4.0 RC2 and earlier allows remote attackers to execute arbitrary SQL commands via the PATH_INFO to index.php. Published: August 14, 2013; 9:49:59 AM -0400 |
V3.x:(not available) V2.0: 7.5 HIGH |