Tribalsystems
Tribalsystems Zenario: vulnerabilidades y CVE
Tribalsystems Zenario tiene 23 vulnerabilidades publicadas, 0 de ellas en los últimos 12 meses. 3 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE23
Últimos 12 meses0
Críticas3
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2024-45964 | Media (4.8) | 0.37% | — | 2 oct 2024 | Zenario 9.7.61188 is vulnerable to Cross Site Scripting (XSS) in the Image library via the "Organizer tags" field. |
| CVE-2024-45960 | Media (4.8) | 0.36% | — | 2 oct 2024 | Zenario 9.7.61188 allows authenticated admin users to upload PDF files containing malicious code into the target system. If the PDF file is accessed through the website, it can trigger a Cross Site Scripting (XSS)… |
| CVE-2024-34461 | Crítica (9.8) | 0.95% | — | 4 may 2024 | Zenario before 9.5.60437 uses Twig filters insecurely in the Twig Snippet plugin, and in the site-wide HEAD and BODY elements, enabling code execution by a designer or an administrator. |
| CVE-2024-34460 | Media (6.5) | 0.55% | — | 4 may 2024 | The Tree Explorer tool from Organizer in Zenario before 9.5.60602 is affected by XSS. (This component was removed in 9.5.60602.) |
| CVE-2023-44769 | Media (5.4) | 0.66% | — | 25 oct 2023 | A Cross-Site Scripting (XSS) vulnerability in Zenario CMS v.9.4.59197 allows a local attacker to execute arbitrary code via a crafted script to the Spare aliases from Alias. |
| CVE-2023-44771 | Media (5.4) | 0.54% | — | 6 oct 2023 | A Cross-Site Scripting (XSS) vulnerability in Zenario CMS v.9.4.59197 allows a local attacker to execute arbitrary code via a crafted script to the Page Layout. |
| CVE-2023-44770 | Media (5.4) | 0.55% | — | 6 oct 2023 | A Cross-Site Scripting (XSS) vulnerability in Zenario CMS v.9.4.59197 allows an attacker to execute arbitrary code via a crafted script to the Organizer - Spare alias. |
| CVE-2023-39578 | Media (4.8) | 0.44% | — | 28 ago 2023 | A stored cross-site scripting (XSS) vulnerability in the Create function of Zenario CMS v9.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Menu navigation text field. |
| CVE-2022-44136 | Crítica (9.8) | 1.2% | — | 30 nov 2022 | Zenario CMS 9.3.57186 is vulnerable to Remote Code Excution (RCE). |
| CVE-2022-4231 | Media (5.4) | 0.47% | — | 30 nov 2022 | A vulnerability, which was classified as problematic, has been found in Tribal Systems Zenario CMS 9.3.57595. This issue affects some unknown processing of the component Remember Me Handler. The manipulation leads to… |
| CVE-2022-44073 | Media (5.4) | 0.47% | — | 16 nov 2022 | Zenario CMS 9.3.57186 is vulnerable to Cross Site Scripting (XSS) via svg,Users & Contacts. |
| CVE-2022-44071 | Media (5.4) | 0.47% | — | 16 nov 2022 | Zenario CMS 9.3.57186 is is vulnerable to Cross Site Scripting (XSS) via profile. |
| CVE-2022-44070 | Media (5.4) | 0.47% | — | 16 nov 2022 | Zenario CMS 9.3.57186 is vulnerable to Cross Site Scripting (XSS) via News articles. |
| CVE-2022-44069 | Media (5.4) | 0.47% | — | 16 nov 2022 | Zenario CMS 9.3.57186 is vulnerable to Cross Site Scripting (XSS) via the Nest library module. |
| CVE-2020-36608 | Media (6.1) | 0.43% | — | 2 nov 2022 | A vulnerability, which was classified as problematic, has been found in Tribal Systems Zenario CMS. Affected by this issue is some unknown functionality of the file admin_organizer.js of the component Error Log Module.… |
| CVE-2021-42171 | Alta (7.2) | 2.5% | — | 14 mar 2022 | Zenario CMS 9.0.54156 is vulnerable to File Upload. The web server can be compromised by uploading and executing a web-shell which can run commands, browse system files, browse local resources, attack other servers, and… |
| CVE-2021-41952 | Media (4.8) | 0.51% | — | 14 mar 2022 | Zenario CMS 9.0.54156 is vulnerable to Cross Site Scripting (XSS) via upload file to *.SVG. An attacker can send malicious files to victims and steals victim's cookie leads to account takeover. The person viewing the… |
| CVE-2022-23043 | Alta (7.2) | 1.5% | — | 24 feb 2022 | Zenario CMS 9.2 allows an authenticated admin user to bypass the file upload restriction by creating a new 'File/MIME Types' using the '.phar' extension. Then an attacker can upload a malicious file, intercept the… |
| CVE-2021-26830 | Crítica (9.1) | 4.6% | — | 16 abr 2021 | SQL Injection in Tribalsystems Zenario CMS 8.8.52729 allows remote attackers to access the database or delete the plugin. This is accomplished via the `ID` input field of ajax.php in the `Pugin library - delete` module. |
| CVE-2021-27673 | Media (4.8) | 1.1% | — | 15 abr 2021 | Cross Site Scripting (XSS) in the "admin_boxes.ajax.php" component of Tribal Systems Zenario CMS v8.8.52729 allows remote attackers to execute arbitrary code by injecting arbitrary HTML into the "cID" parameter when… |
| CVE-2021-27672 | Media (4.9) | 1.3% | — | 15 abr 2021 | SQL Injection in the "admin_boxes.ajax.php" component of Tribal Systems Zenario CMS v8.8.52729 allows remote attackers to obtain sesnitive database information by injecting SQL commands into the "cID" parameter when… |
| CVE-2018-18420 | Alta (8.8) | 0.82% | — | 19 oct 2018 | Cross-Site Request Forgery (CSRF) vulnerability was discovered in the 8.3 version of Zenario Content Management System via the admin/organizer.ajax.php?path=zenario__content%2Fpanels%2Fcontent URI. |
| CVE-2018-5960 | Alta (8.8) | 0.93% | — | 22 ene 2018 | Zenario v7.1 - v7.6 has SQL injection via the `Name` input field of organizer.php or admin_boxes.ajax.php in the `Categories - Edit` module. |