bosscms records

5 published records for vendor bosscms.

Researcher profile

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

5 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
39Monitor	CVE-2022-28606No exploit	An arbitrary file upload vulnerability exists in Wenzhou Huoyin Information Technology Co., Ltd.bosscms · bosscms · CWE-434 Pre-auth File upload	Critical9.8	—	1.5%	May 5, 2022
31Monitor	CVE-2024-22938No exploit	Insecure Permissions vulnerability in BossCMS v.1.3.0 allows a local attacker to execute arbitrary code and escalate privileges via the initbosscms · bosscms · CWE-863 RCE Local privilege escalation Broken access control (IDOR)	High7.8	—	0.3%	Jan 29, 2024
28Monitor	CVE-2024-31609No exploit	Cross Site Scripting (XSS) vulnerability in BOSSCMS v3.10 allows attackers to run arbitrary code via the header code and footer code fields bosscms · bosscms · CWE-79 pre-auth RCE XSS	High7.1	—	0.4%	Apr 25, 2024
26Monitor	CVE-2022-44937No exploit	Bosscms v2.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Add function under the Administrator List module.bosscms · bosscms · CWE-352 Pre-auth CSRF	Medium6.5	—	0.3%	Nov 28, 2022
21Monitor	CVE-2024-31613No exploit	BOSSCMS v3.10 is vulnerable to Cross Site Request Forgery (CSRF) in name="head_code" or name="foot_code."bosscms · bosscms · CWE-352 CSRF	Medium5.4	—	0.2%	Jun 10, 2024

CVE-2022-28606
39Monitor
An arbitrary file upload vulnerability exists in Wenzhou Huoyin Information Technology Co., Ltd.
CriticalCVSS 9.8No exploitEPSS 2%
- Pre-auth
- File upload
bosscms · bosscmsMay 5, 2022
CVE-2024-22938
31Monitor
Insecure Permissions vulnerability in BossCMS v.1.3.0 allows a local attacker to execute arbitrary code and escalate privileges via the init
HighCVSS 7.8No exploitEPSS 0%
bosscms · bosscmsJan 29, 2024
CVE-2024-31609
28Monitor
Cross Site Scripting (XSS) vulnerability in BOSSCMS v3.10 allows attackers to run arbitrary code via the header code and footer code fields
HighCVSS 7.1No exploitEPSS 0%
- pre-auth RCE
- XSS
bosscms · bosscmsApr 25, 2024
CVE-2022-44937
26Monitor
Bosscms v2.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Add function under the Administrator List module.
MediumCVSS 6.5No exploitEPSS 0%
- Pre-auth
- CSRF
bosscms · bosscmsNov 28, 2022
CVE-2024-31613
21Monitor
BOSSCMS v3.10 is vulnerable to Cross Site Request Forgery (CSRF) in name="head_code" or name="foot_code."
MediumCVSS 5.4No exploitEPSS 0%
- CSRF
bosscms · bosscmsJun 10, 2024