Bigtreecms vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2020-26670 A vulnerability has been discovered in BigTree CMS 4.4.10 and earlier which allows an authenticated attacker to execute arbitrary commands through a crafted reqHigh 8.8 · Jun 1, 2021
• CVE-2020-26668 A SQL injection vulnerability was discovered in /core/feeds/custom.php in BigTree CMS 4.4.10 and earlier which allows an authenticated attacker to inject a maliHigh 8.8 · Jun 1, 2021
• CVE-2018-17341 BigTree 4.2.23 on Windows, when Advanced or Simple Rewrite routing is enabled, allows remote attackers to bypass authentication via a ..\ substring, as demonstrHigh 8.1 · Sep 23, 2018
• CVE-2018-17030 BigTree CMS 4.2.23 allows remote authenticated users, if possessing privileges to set hooks, to execute arbitrary code via /core/admin/auto-modules/forms/procesHigh 7.5 · Sep 13, 2018
• CVE-2018-10574 site/index.php/admin/trees/add/ in BigTree 4.2.22 and earlier allows remote attackers to upload and execute arbitrary PHP code because the BigTreeStorage class Critical 9.8 · Apr 30, 2018
• CVE-2017-11736 SQL injection vulnerability in core\admin\auto-modules\forms\process.php in BigTree 4.2.18 allows remote authenticated users to execute arbitrary SQL commands vHigh 8.8 · Jul 29, 2017
• CVE-2017-9449 SQL injection vulnerability in BigTree CMS through 4.2.18 allows remote authenticated users to execute arbitrary SQL commands via core/admin/modules/developer/mHigh 8.8 · Jun 6, 2017
• CVE-2017-9444 BigTree CMS through 4.2.18 has CSRF related to the core\admin\modules\users\profile\update.php script (modify user information), the index.php/admin/developer/pHigh 8.8 · Jun 5, 2017
• CVE-2017-9443 BigTree CMS through 4.2.18 allows remote authenticated users to conduct SQL injection attacks via a crafted tables object in manifest.json in an uploaded packagHigh 8.8 · Jun 5, 2017
• CVE-2017-9442 BigTree CMS through 4.2.18 allows remote authenticated users to execute arbitrary code by uploading a crafted package containing a PHP web shell, related to extHigh 8.8 · Jun 5, 2017
• CVE-2017-9428 A directory traversal vulnerability exists in core\admin\ajax\developer\extensions\file-browser.php in BigTree CMS through 4.2.18 on Windows, allowing attackersHigh 7.5 · Jun 4, 2017
• CVE-2017-9427 SQL injection vulnerability in BigTree CMS through 4.2.18 allows remote authenticated users to execute arbitrary SQL commands via core\admin\modules\developer\mHigh 8.8 · Jun 4, 2017
• CVE-2017-9379 Multiple CSRF issues exist in BigTree CMS through 4.2.18 - the clear parameter to core\admin\modules\dashboard\vitals-statistics\404\clear.php and the from or tHigh 8.8 · Jun 2, 2017
• CVE-2017-9365 CSRF exists in BigTree CMS through 4.2.18 with the force parameter to /admin/pages/revisions.php - for example: /admin/pages/revisions/1/?force=false.High 8.8 · Jun 2, 2017
• CVE-2017-9364 Unrestricted File Upload exists in BigTree CMS through 4.2.18: if an attacker uploads an 'xxx.pht' or 'xxx.phtml' file, they could bypass a safety check and exeCritical 9.8 · Jun 2, 2017
• CVE-2017-7881 BigTree CMS through 4.2.17 relies on a substring check for CSRF protection, which allows remote attackers to bypass this check by placing the required admin/devHigh 8.8 · Apr 15, 2017
• CVE-2017-7695 Unrestricted File Upload exists in BigTree CMS before 4.2.17: if an attacker uploads an 'xxx.php[space]' file, they could bypass a safety check and execute any Critical 9.8 · Apr 11, 2017
• CVE-2017-6914 CSRF exists in BigTree CMS 4.1.18 and 4.2.16 with the id parameter to the admin/ajax/users/delete/ page.High 7.1 · Mar 15, 2017
• CVE-2013-4879 SQL injection vulnerability in core/inc/bigtree/cms.php in BigTree CMS 4.0 RC2 and earlier allows remote attackers to execute arbitrary SQL commands via the PATHigh 7.5 · Aug 14, 2013