Doorgets
Doorgets CMS: vulnerabilidades y CVE
Doorgets CMS tiene 22 vulnerabilidades publicadas, 0 de ellas en los últimos 12 meses. 2 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE22
Últimos 12 meses0
Críticas2
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2019-11626 | Media (5.3) | 1.3% | — | 30 abr 2019 | routers/ajaxRouter.php in doorGets 7.0 has a web site physical path leakage vulnerability, as demonstrated by an ajax/index.php?uri=1234%5c request. |
| CVE-2019-11625 | Media (4.9) | 1.2% | — | 30 abr 2019 | doorGets 7.0 has a SQL injection vulnerability in /doorgets/app/requests/user/emailingRequest.php. A remote background administrator privilege user (or a user with permission to manage emailing) could exploit the… |
| CVE-2019-11624 | Media (4.9) | 1.6% | — | 30 abr 2019 | doorGets 7.0 has an arbitrary file deletion vulnerability in /doorgets/app/requests/user/configurationRequest.php. A remote background administrator privilege user can exploit this vulnerability to delete arbitrary… |
| CVE-2019-11623 | Media (4.9) | 1.2% | — | 30 abr 2019 | doorGets 7.0 has a SQL injection vulnerability in /doorgets/app/requests/user/configurationRequest.php when action=siteweb. A remote background administrator privilege user (or a user with permission to manage… |
| CVE-2019-11622 | Media (4.9) | 1.2% | — | 30 abr 2019 | doorGets 7.0 has a SQL injection vulnerability in /doorgets/app/requests/user/modulecategoryRequest.php. A remote background administrator privilege user (or a user with permission to manage modulecategory) could… |
| CVE-2019-11621 | Media (4.9) | 1.2% | — | 30 abr 2019 | doorGets 7.0 has a SQL injection vulnerability in /doorgets/app/requests/user/configurationRequest.php when action=network. A remote background administrator privilege user (or a user with permission to manage network… |
| CVE-2019-11620 | Media (4.9) | 1.2% | — | 30 abr 2019 | doorGets 7.0 has a SQL injection vulnerability in /doorgets/app/requests/user/modulecategoryRequest.php. A remote background administrator privilege user (or a user with permission to manage modulecategory) could… |
| CVE-2019-11619 | Media (4.9) | 1.2% | — | 30 abr 2019 | doorGets 7.0 has a SQL injection vulnerability in /doorgets/app/requests/user/configurationRequest.php when action=analytics. A remote background administrator privilege user (or a user with permission to manage… |
| CVE-2019-11618 | Crítica (9.8) | 2.3% | — | 30 abr 2019 | doorGets 7.0 has a default administrator credential vulnerability. A remote attacker can use this vulnerability to gain administrator privileges for the creation and modification of articles via an… |
| CVE-2019-11617 | Alta (8.8) | 0.82% | — | 30 abr 2019 | doorGets 7.0 has a CSRF vulnerability in /doorgets/app/requests/user/configurationRequest.php. A remote attacker can exploit this vulnerability for "Google Analytics code" modification. |
| CVE-2019-11616 | Crítica (9.8) | 2.4% | — | 30 abr 2019 | doorGets 7.0 has a sensitive information disclosure vulnerability in /setup/temp/admin.php and /setup/temp/database.php. A remote unauthenticated attacker could exploit this vulnerability to obtain the administrator… |
| CVE-2019-11615 | Alta (8.8) | 1.5% | — | 30 abr 2019 | /fileman/php/upload.php in doorGets 7.0 has an arbitrary file upload vulnerability. A remote normal registered user can use this vulnerability to upload backdoor files to control the server. |
| CVE-2019-11614 | Alta (7.5) | 1.5% | — | 30 abr 2019 | doorGets 7.0 has a SQL injection vulnerability in /doorgets/app/views/ajax/commentView.php. A remote unauthorized attacker could exploit the vulnerability to obtain database sensitive information. |
| CVE-2019-11613 | Media (6.5) | 1.2% | — | 30 abr 2019 | doorGets 7.0 has a SQL injection vulnerability in /doorgets/app/views/ajax/contactView.php. A remote normal registered user could exploit the vulnerability to obtain database sensitive information. |
| CVE-2019-11612 | Alta (7.5) | 2.7% | — | 30 abr 2019 | doorGets 7.0 has an arbitrary file deletion vulnerability in /fileman/php/deletefile.php. A remote unauthenticated attacker can exploit this vulnerability to delete arbitrary files. |
| CVE-2019-11611 | Alta (7.5) | 3.9% | — | 30 abr 2019 | doorGets 7.0 has a sensitive information disclosure vulnerability in /fileman/php/download.php. A remote unauthenticated attacker can exploit this vulnerability to obtain server-sensitive information. |
| CVE-2019-11610 | Alta (7.5) | 3.9% | — | 30 abr 2019 | doorGets 7.0 has a sensitive information disclosure vulnerability in /fileman/php/downloaddir.php. A remote unauthenticated attacker can exploit this vulnerability to obtain server-sensitive information. |
| CVE-2019-11609 | Alta (8.2) | 4.0% | — | 30 abr 2019 | doorGets 7.0 has a sensitive information disclosure vulnerability in /fileman/php/movefile.php. A remote unauthenticated attacker can exploit this vulnerability to obtain server-sensitive information or make the server… |
| CVE-2019-11608 | Alta (8.2) | 4.1% | — | 30 abr 2019 | doorGets 7.0 has a sensitive information disclosure vulnerability in /fileman/php/renamefile.php. A remote unauthenticated attacker can exploit this vulnerability to obtain server-sensitive information or make the… |
| CVE-2019-11607 | Alta (7.5) | 3.9% | — | 30 abr 2019 | doorGets 7.0 has a sensitive information disclosure vulnerability in /fileman/php/copydir.php. A remote unauthenticated attacker can exploit this vulnerability to obtain server-sensitive information. |
| CVE-2019-11606 | Alta (7.5) | 3.9% | — | 30 abr 2019 | doorGets 7.0 has a sensitive information disclosure vulnerability in /fileman/php/copyfile.php. A remote unauthenticated attacker can exploit this vulnerability to obtain server-sensitive information. |
| CVE-2014-1459 | Media (6.5) | 2.3% | — | 11 feb 2014 | SQL injection vulnerability in dg-admin/index.php in doorGets CMS 5.2 and earlier allows remote authenticated administrators to execute arbitrary SQL commands via the _position_down_id parameter. NOTE: this can be… |