Total
8 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2020-18127 | 1 Indexhibit | 1 Indexhibit | 2024-11-21 | 4.0 MEDIUM | 6.5 MEDIUM |
|
An issue in the /config/config.php component of Indexhibit 2.1.5 allows attackers to arbitrarily view files.
|
|||||
| CVE-2020-18126 | 1 Indexhibit | 1 Indexhibit | 2024-11-21 | 3.5 LOW | 5.4 MEDIUM |
|
Multiple stored cross-site scripting (XSS) vulnerabilities in the Sections module of Indexhibit 2.1.5 allows attackers to execute arbitrary web scripts or HTML.
|
|||||
| CVE-2020-18125 | 1 Indexhibit | 1 Indexhibit | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
|
A reflected cross-site scripting (XSS) vulnerability in the /plugin/ajax.php component of Indexhibit 2.1.5 allows attackers to execute arbitrary web scripts or HTML.
|
|||||
| CVE-2020-18124 | 1 Indexhibit | 1 Indexhibit | 2024-11-21 | 4.0 MEDIUM | 5.7 MEDIUM |
|
A cross-site request forgery (CSRF) vulnerability in Indexhibit 2.1.5 allows attackers to arbitrarily reset account passwords.
|
|||||
| CVE-2020-18123 | 1 Indexhibit | 1 Indexhibit | 2024-11-21 | 4.3 MEDIUM | 6.5 MEDIUM |
|
A cross-site request forgery (CSRF) vulnerability in Indexhibit 2.1.5 allows attackers to arbitrarily delete admin accounts.
|
|||||
| CVE-2020-18121 | 1 Indexhibit | 1 Indexhibit | 2024-11-21 | 6.5 MEDIUM | 8.8 HIGH |
|
A configuration issue in Indexhibit 2.1.5 allows authenticated attackers to modify .php files, leading to getshell.
|
|||||
| CVE-2019-8954 | 1 Indexhibit | 1 Indexhibit | 2024-11-21 | 6.5 MEDIUM | 8.8 HIGH |
|
In Indexhibit 2.1.5, remote attackers can execute arbitrary code via the v parameter (in conjunction with the id parameter) in a upd_jxcode=true action to the ndxzstudio/?a=system URI.
|
|||||
| CVE-2019-16314 | 1 Indexhibit | 1 Indexhibit | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
|
Indexhibit 2.1.5 allows a product reinstallation, with resultant remote code execution, via /ndxzstudio/install.php?p=2.
|
|||||