Vulnerabilidades
Resumen — últimos 7 días
Vulnerabilidades nuevas2841▼ 157 respecto a la semana anterior
Críticas / altas1370▲ 51 respecto a la semana anterior
Nueva explotación activa (KEV)5▼ 3 respecto a la semana anterior
Sin puntuar (sin CVSS)266▼ 258 respecto a la semana anterior
7 resultados, ordenados por fecha de publicación (más recientes primero)
| CVE | Estado | Severidad | EPSS | Explotación activa | Tecnologías afectadas | Publicada ▼ | Modificada | Descripción |
|---|---|---|---|---|---|---|---|---|
| Modificada | Media (6.1) | 0.84% | — | Movabletype Movable TypeMovabletype Movable Type AdvancedMovabletype Movable Type PremiumMovabletype Movable Type Premium Advanced | 5/3/2021 | 17/6/2026 | Cross-site scripting vulnerability in in Add asset screen of Contents field of Movable Type 7 r.4705 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.4705 and earlier (Movable Type Advanced 7 Series), Movable Type Premium 1.39 and earlier, and Movable Type Premium Advanced 1.39 and earlier allows remote… | |
| Modificada | Media (6.1) | 0.84% | — | Movabletype Movable TypeMovabletype Movable Type AdvancedMovabletype Movable Type PremiumMovabletype Movable Type Premium Advanced | 5/3/2021 | 17/6/2026 | Cross-site scripting vulnerability in in Asset registration screen of Movable Type 7 r.4705 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.4705 and earlier (Movable Type Advanced 7 Series), Movable Type 6.7.5 and earlier (Movable Type 6.7 Series), Movable Type Premium 1.39 and earlier, and Movable Type… | |
| Modificada | Media (6.1) | 0.84% | — | Movabletype Movable TypeMovabletype Movable Type AdvancedMovabletype Movable Type PremiumMovabletype Movable Type Premium Advanced | 5/3/2021 | 17/6/2026 | Cross-site scripting vulnerability in in Role authority setting screen of Movable Type 7 r.4705 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.4705 and earlier (Movable Type Advanced 7 Series), Movable Type 6.7.5 and earlier (Movable Type 6.7 Series), Movable Type Premium 1.39 and earlier, and Movable… | |
| Modificada | Media (4) | 1.8% | — | Movabletype Movable Type Open SourceMovabletype Movable Type EnterpriseMovabletype Movable Type AdvancedMovabletype Movable Type PRO | 3/3/2012 | 16/6/2026 | The default configuration of Movable Type before 4.38, 5.0x before 5.07, and 5.1x before 5.13 supports the "mt:Include file=" attribute, which allows remote authenticated users to conduct directory traversal attacks and read arbitrary files by leveraging the template-designer role. | |
| Modificada | Media (4.3) | 1.9% | — | Movabletype Movable Type Open SourceMovabletype Movable Type EnterpriseMovabletype Movable Type AdvancedMovabletype Movable Type PRO | 3/3/2012 | 16/6/2026 | Cross-site scripting (XSS) vulnerability in cgi-bin/mt/mt-wizard.cgi in Movable Type before 4.38, 5.0x before 5.07, and 5.1x before 5.13, when the product is incompletely installed, allows remote attackers to inject arbitrary web script or HTML via the dbuser parameter, a different vulnerability than CVE-2012-0318. | |
| Modificada | Media (6.5) | 2.4% | — | Movabletype Movable Type Open SourceMovabletype Movable Type EnterpriseMovabletype Movable Type AdvancedMovabletype Movable Type PRO | 3/3/2012 | 16/6/2026 | The file-management system in Movable Type before 4.38, 5.0x before 5.07, and 5.1x before 5.13 allows remote authenticated users to execute arbitrary commands by leveraging the file-upload feature, related to an "OS Command Injection" issue. | |
| Modificada | Media (4.3) | 1.3% | — | Movabletype Movable Type Open SourceMovabletype Movable Type EnterpriseMovabletype Movable Type AdvancedMovabletype Movable Type PRO | 3/3/2012 | 16/6/2026 | Multiple cross-site scripting (XSS) vulnerabilities in Movable Type before 4.38, 5.0x before 5.07, and 5.1x before 5.13 allow remote attackers to inject arbitrary web script or HTML via vectors involving templates, a different issue than CVE-2012-1262. |