Vulnerabilidades
Resumen — últimos 7 días
Vulnerabilidades nuevas2557▼ 320 respecto a la semana anterior
Críticas / altas1342▲ 78 respecto a la semana anterior
Nueva explotación activa (KEV)5▼ 7 respecto a la semana anterior
Sin puntuar (sin CVSS)62▼ 466 respecto a la semana anterior
10 resultados, ordenados por fecha de publicación (más recientes primero)
| CVE | Estado | Severidad | EPSS | Explotación activa | Tecnologías afectadas | Publicada ▼ | Modificada | Descripción |
|---|---|---|---|---|---|---|---|---|
| Modificada | Media (6) | 1.5% | — | Karl Core Bandsite CMS | 22/4/2010 | 16/6/2026 | Unrestricted file upload vulnerability in adminpanel/scripts/addphotos.php in BandSite CMS 1.1.4 allows remote authenticated administrators to execute arbitrary PHP code by uploading a file with an executable extension via an addphotos action to adminpanel/index.php, and then accessing the file via a direct request… | |
| Modificada | Alta (7.5) | 0.99% | — | Karl Core Bandsite CMS | 22/4/2010 | 16/6/2026 | SQL injection vulnerability in includes/content/member_content.php in BandSite CMS 1.1.4 allows remote attackers to execute arbitrary SQL commands via the memid parameter to members.php. | |
| Modificada | Media (6.8) | 0.94% | — | Grayscalecms Bandsite CMS | 24/8/2009 | 16/6/2026 | Cross-site request forgery (CSRF) vulnerability in BandSite CMS 1.1.4 allows remote attackers to hijack the authentication of administrators and force a logout via adminpanel/logout.php. | |
| Modificada | Media (4.3) | 1.5% | — | Grayscalecms Bandsite CMS | 24/8/2009 | 16/6/2026 | Cross-site scripting (XSS) vulnerability in merchandise.php in BandSite CMS 1.1.4 allows remote attackers to inject arbitrary HTML or web script via the type parameter. | |
| Modificada | Media (5) | 2.5% | — | Grayscalecms Bandsite CMS | 24/8/2009 | 16/6/2026 | BandSite CMS 1.1.4 does not perform access control for adminpanel/phpmydump.php, which allows remote attackers to obtain copies of the database via a direct request. | |
| Modificada | Alta (7.5) | 2.8% | — | Bandsitecms Bandsite CMS | 12/12/2008 | 16/6/2026 | BandSite CMS 1.1.4 allows remote attackers to bypass authentication and gain administrative access by setting the login_auth cookie to true. | |
| Modificada | Media (5) | 1.5% | — | Grayscale Bandsite CMS | 26/9/2006 | 16/6/2026 | Grayscale BandSite CMS allows remote attackers to obtain sensitive information via a direct request for (1) certain files in the includes/content directory, (2) includes/shows_preview.php, and (3) adminpanel/configform.php; and files in adminpanel/includes/ including (4) mailinglist/disphtmltbl.php, (5)… | |
| Modificada | Media (4.3) | 1.7% | — | Grayscale Bandsite CMS | 26/9/2006 | 16/6/2026 | Multiple cross-site scripting (XSS) vulnerabilities in Grayscale BandSite CMS allow remote attackers to inject arbitrary web script or HTML via (1) the max_file_size_purdy parameter in adminpanel/includes/helpfiles/help_mp3.php, (2) the message_text parameter in adminpanel/includes/mailinglist/sendemail.php, (3) the… | |
| Modificada | Alta (7.5) | 1.6% | — | Grayscale Bandsite CMS | 26/9/2006 | 16/6/2026 | Multiple PHP remote file inclusion vulnerabilities in Grayscale BandSite CMS allow remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[root_path] parameter in (1) adminpanel/includes/mailinglist/mlist_xls.php and (2) adminpanel/includes/add_forms/addmp3.php. NOTE: the other vectors from the… | |
| Modificada | Media (5.1) | 15% | — | Grayscale Bandsite CMS | 23/6/2006 | 16/6/2026 | Multiple PHP remote file inclusion vulnerabilities in Grayscale BandSite CMS 1.1.1, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the root_path parameter to (1) includes/content/contact_content.php; multiple files in adminpanel/includes/add_forms/ including (2)… |