Pligg vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2024-42621 Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_editor.phpHigh 8.8 · Aug 20, 2024
• CVE-2024-42618 Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /module.php?module=karmaHigh 8.8 · Aug 20, 2024
• CVE-2024-42616 Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_widgets.php?action=remove&widget=StatisticsHigh 8.8 · Aug 20, 2024
• CVE-2024-42613 Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_widgets.php?action=install&widget=akismetHigh 8.8 · Aug 20, 2024
• CVE-2024-42610 Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_backup.php?dobackup=filesHigh 8.8 · Aug 20, 2024
• CVE-2024-42609 Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_backup.php?dobackup=avatarsHigh 8.8 · Aug 20, 2024
• CVE-2024-42607 Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_backup.php?dobackup=databaseHigh 8.8 · Aug 20, 2024
• CVE-2024-42606 Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_log.php?clear=1High 8.8 · Aug 20, 2024
• CVE-2024-42605 Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/edit_page.php?link_id=1High 8.8 · Aug 20, 2024
• CVE-2024-42604 Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_group.php?mode=delete&group_id=3High 8.8 · Aug 20, 2024
• CVE-2024-42603 Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_backup.php?dobackup=clearallHigh 8.8 · Aug 20, 2024
• CVE-2024-42608 Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/submit_page.php.High 8.8 · Aug 20, 2024
• CVE-2023-37677 Pligg CMS v2.0.2 (also known as Kliqqi) was discovered to contain a remote code execution (RCE) vulnerability in the component admin_editor.php.Critical 9.8 · Jul 25, 2023
• CVE-2022-34956 Pligg CMS v2.0.2 was discovered to contain a time-based SQL injection vulnerability via the page_size parameter at load_data_for_groups.php.Critical 9.8 · Aug 1, 2022
• CVE-2022-34955 Pligg CMS v2.0.2 was discovered to contain a time-based SQL injection vulnerability via the page_size parameter at load_data_for_topusers.php.Critical 9.8 · Aug 1, 2022
• CVE-2014-9096 Multiple SQL injection vulnerabilities in recover.php in Pligg CMS 2.0.1 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id or High 7.5 · Nov 26, 2014
• CVE-2012-2937 Multiple SQL injection vulnerabilities in Pligg CMS before 1.2.2 allow remote attackers to execute arbitrary SQL commands via the (1) list parameter in a move aHigh 7.5 · May 27, 2012
• CVE-2011-5022 SQL injection vulnerability in search.php in Pligg CMS 1.1.2 allows remote attackers to execute arbitrary SQL commands via the status parameter.High 7.5 · Dec 29, 2011
• CVE-2010-3013 SQL injection vulnerability in groupadmin.php in Pligg before 1.1.1 allows remote attackers to execute arbitrary SQL commands via the role parameter, a differenHigh 7.5 · Aug 16, 2010
• CVE-2010-2577 Multiple SQL injection vulnerabilities in Pligg before 1.1.1 allow remote attackers to execute arbitrary SQL commands via the title parameter to (1) storyrss.phHigh 7.5 · Aug 16, 2010
• CVE-2008-7091 Multiple SQL injection vulnerabilities in Pligg 9.9 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to vote.php, wHigh 7.5 · Aug 26, 2009
• CVE-2008-7090 Multiple directory traversal vulnerabilities in Pligg 9.9 and earlier allow remote attackers to (1) determine the existence of arbitrary files via a ..High 7.8 · Aug 26, 2009
• CVE-2008-6968 Multiple SQL injection vulnerabilities in submit.php in Pligg CMS 9.9.5 allow remote attackers to execute arbitrary SQL commands via the (1) category and (2) idHigh 7.5 · Aug 13, 2009
• CVE-2008-5739 SQL injection vulnerability in evb/check_url.php in Pligg CMS 9.9.5 Beta allows remote attackers to execute arbitrary SQL commands via the url parameter.High 7.5 · Dec 26, 2008
• CVE-2008-3366 SQL injection vulnerability in story.php in Pligg CMS Beta 9.9.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.High 7.5 · Jul 30, 2008