Vulnerabilidades

Resumen — últimos 7 días

Vulnerabilidades nuevas2738▲ 10 respecto a la semana anterior

Críticas / altas1458▲ 322 respecto a la semana anterior

Nueva explotación activa (KEV)7▼ 3 respecto a la semana anterior

Sin puntuar (sin CVSS)85▼ 441 respecto a la semana anterior

8 resultados, ordenados por fecha de publicación (más recientes primero)

CVE	Estado	Severidad	EPSS	Explotación activa	Tecnologías afectadas	Publicada ▼	Modificada	Descripción
CVE-2023-53884	Analizada	Media (5.1)	0.27%	—	Webedition CMS	15/12/2025	17/6/2026	Webedition CMS v2.9.8.8 contains a stored cross-site scripting vulnerability that allows authenticated users to upload malicious SVG files with embedded JavaScript. Attackers can upload crafted SVG files through the media upload feature to inject and execute arbitrary scripts when the file is viewed by other users.
CVE-2023-53883	Analizada	Alta (8.6)	1.0%	—	Webedition CMS	15/12/2025	17/6/2026	Webedition CMS v2.9.8.8 contains a remote code execution vulnerability that allows authenticated attackers to inject system commands through PHP page creation. Attackers can create a new PHP page with malicious system commands in the description field to execute arbitrary commands on the server.
CVE-2024-28418	Analizada	Media (6.5)	0.44%	—	Webedition CMS	14/3/2024	17/6/2026	Webedition CMS 9.2.2.0 has a File upload vulnerability via /webEdition/we_cmd.php
CVE-2024-28417	Analizada	Media (6.3)	0.35%	—	Webedition CMS	14/3/2024	17/6/2026	Webedition CMS 9.2.2.0 has a Stored XSS vulnerability via /webEdition/we_cmd.php.
CVE-2014-2302	Modificada	Crítica (9.8)	4.5%	—	Webedition CMS	19/7/2018	17/6/2026	The installer script in webEdition CMS before 6.2.7-s1 and 6.3.x before 6.3.8-s1 allows remote attackers to conduct PHP Object Injection attacks by intercepting a request to update.webedition.org.
CVE-2014-5258	Modificada	Media (4)	20%	—	Webedition CMS	6/11/2014	17/6/2026	Directory traversal vulnerability in showTempFile.php in webEdition CMS before 6.3.9.0 Beta allows remote authenticated users to read arbitrary files via a .. (dot dot) in the file parameter.
CVE-2014-2303	Modificada	Alta (7.5)	2.6%	—	Webedition CMS	13/6/2014	17/6/2026	Multiple SQL injection vulnerabilities in the file browser component (we_fs.php) in webEdition CMS before 6.2.7-s1.2 and 6.3.x through 6.3.8 before -s1 allow remote attackers to execute arbitrary SQL commands via the (1) table or (2) order parameter.
CVE-2008-4154	Modificada	Alta (7.5)	1.00%	—	Living-e Webedition CMS	19/9/2008	16/6/2026	SQL injection vulnerability in living-e webEdition CMS allows remote attackers to execute arbitrary SQL commands via the we_objectID parameter.