Sign in Free account Free scan

automad records

8 published records for vendor automad.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 0
With a fix record: 37.5%
Median publish → KEV: No record has entered KEV

Records by year

22
23
24

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

8 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
35Monitor	CVE-2024-40400No exploit	An arbitrary file upload vulnerability in the image upload function of Automad v2.0.0 allows attackers to execute arbitrary code via a craftautomad · automad · CWE-434 RCE File upload	High8.8	—	0.8%	Jul 19, 2024
35Monitor	CVE-2023-7037No exploit	automad FileController.php import server-side request forgeryautomad · automad · CWE-918 SSRF	High8.8	—	0.7%	Dec 21, 2023
26Monitor	CVE-2023-7038No exploit	automad User Creation cross-site request forgeryautomad · automad · CWE-352 Pre-auth CSRF	Medium6.5	—	0.3%	Dec 21, 2023
21Monitor	CVE-2022-1536No exploit	automad Dashboard cross site scriptingautomad · automad · CWE-79 XSS	Medium5.4	—	0.6%	Apr 29, 2022
21Monitor	CVE-2023-7036No exploit	automad Content Type FileCollectionController.php upload unrestricted uploadautomad · automad · CWE-434 File upload	Medium5.4	—	0.5%	Dec 21, 2023
21Monitor	CVE-2021-37502No exploit	Cross Site Scripting (XSS) vulnerability in automad 1.7.5 allows remote attackers to run arbitrary code via the user name field when adding automad · automad · CWE-79 RCE XSS	Medium5.4	—	0.5%	Feb 3, 2023
19Monitor	CVE-2024-40111Proof of concept	A persistent (stored) cross-site scripting (XSS) vulnerability has been identified in Automad 2.0.0-alpha.4.automad · automad · CWE-79 XSS	Medium4.8	—	0.8%	Aug 23, 2024
7Monitor	CVE-2023-7035No exploit	automad Setting post.php cross site scriptingautomad · automad · CWE-79 XSS	Low1.9	—	0.6%	Dec 21, 2023

CVE-2024-40400
35Monitor
An arbitrary file upload vulnerability in the image upload function of Automad v2.0.0 allows attackers to execute arbitrary code via a craft
HighCVSS 8.8No exploitEPSS 0%
- RCE
- File upload
automad · automadJul 19, 2024
CVE-2023-7037
35Monitor
automad FileController.php import server-side request forgery
HighCVSS 8.8No exploitEPSS 0%
- SSRF
automad · automadDec 21, 2023
CVE-2023-7038
26Monitor
automad User Creation cross-site request forgery
MediumCVSS 6.5No exploitEPSS 0%
- Pre-auth
- CSRF
automad · automadDec 21, 2023
CVE-2022-1536
21Monitor
automad Dashboard cross site scripting
MediumCVSS 5.4No exploitEPSS 0%
- XSS
automad · automadApr 29, 2022
CVE-2023-7036
21Monitor
automad Content Type FileCollectionController.php upload unrestricted upload
MediumCVSS 5.4No exploitEPSS 0%
- File upload
automad · automadDec 21, 2023
CVE-2021-37502
21Monitor
Cross Site Scripting (XSS) vulnerability in automad 1.7.5 allows remote attackers to run arbitrary code via the user name field when adding
MediumCVSS 5.4No exploitEPSS 0%
- RCE
- XSS
automad · automadFeb 3, 2023
CVE-2024-40111
19Monitor
A persistent (stored) cross-site scripting (XSS) vulnerability has been identified in Automad 2.0.0-alpha.4.
MediumCVSS 4.8Proof of conceptEPSS 0%
- XSS
automad · automadAug 23, 2024
CVE-2023-7035
7Monitor
automad Setting post.php cross site scripting
LowCVSS 1.9No exploitEPSS 0%
- XSS
automad · automadDec 21, 2023