Vulnerabilidades
Resumen — últimos 7 días
Vulnerabilidades nuevas2507▼ 423 respecto a la semana anterior
Críticas / altas1283▲ 4 respecto a la semana anterior
Nueva explotación activa (KEV)6▼ 5 respecto a la semana anterior
Sin puntuar (sin CVSS)62▼ 465 respecto a la semana anterior
8 resultados, ordenados por fecha de publicación (más recientes primero)
| CVE | Estado | Severidad | EPSS | Explotación activa | Tecnologías afectadas | Publicada ▼ | Modificada | Descripción |
|---|---|---|---|---|---|---|---|---|
| Modificada | Alta (8.8) | 0.77% | — | Lepton-cms Leptoncms | 9/12/2025 | 5/7/2026 | LeptonCMS version 7.3.0 contains an arbitrary file upload vulnerability, which is caused by the lack of proper validation for uploaded files. An authenticated attacker can exploit this vulnerability by uploading a specially crafted ZIP/PHP file to execute arbitrary code. | |
| Analizada | Alta (8.8) | 1.3% | — | Lepton-cms Leptoncms | 2/4/2024 | 17/6/2026 | File Upload vulnerability in lepton v.7.1.0 allows a remote authenticated attackers to execute arbitrary code via uploading a crafted PHP file. | |
| Analizada | Alta (8.8) | 1.2% | — | Lepton-cms Leptoncms | 25/3/2024 | 17/6/2026 | File Upload vulnerability in lepton v.7.1.0 allows a remote authenticated attackers to execute arbitrary code via uploading a crafted PHP file to the save.php and config.php component. | |
| Modificada | Alta (7.8) | 0.42% | — | Lepton-cms Leptoncms | 21/3/2024 | 9/7/2026 | An issue in Lepton CMS v.7.0.0 allows a local attacker to execute arbitrary code via the upgrade.php file in the languages place. | |
| Modificada | Alta (7.2) | 16% | — | Lepton-cms Leptoncms | 25/1/2024 | 17/6/2026 | An arbitrary file upload vulnerability in LEPTON v7.0.0 allows authenticated attackers to execute arbitrary PHP code by uploading this code to the backend/languages/index.php languages area. | |
| Modificada | Media (6.1) | 0.51% | — | Lepton-cms Leptoncms | 11/8/2023 | 17/6/2026 | Cross Site Scripting (XSS) vulnerability in backend/pages/modify.php in Lepton-CMS version 4.7.0, allows remote attackers to execute arbitrary code. | |
| Modificada | Media (4.8) | 1.7% | — | Lepton-cms Leptoncms | 2/12/2020 | 17/6/2026 | Lepton-CMS 4.7.0 is affected by cross-site scripting (XSS). An attacker can inject the XSS payload in the URL field of the admin page and each time an admin visits the Menu-Pages-Pages Overview section, the XSS will be triggered. | |
| Modificada | Media (6.1) | 0.64% | — | Lepton-cms Leptoncms | 7/5/2020 | 17/6/2026 | Multiple cross-site scripting (XSS) vulnerabilities exist in LeptonCMS before 4.6.0. |