Skip to content
Noroxi

cuppacms records

25 published records for vendor cuppacms.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
4
With a fix record
0%
Median publish → KEV
No record has entered KEV

Records by year

  1. 18
  2. 20
  3. 21
  4. 22
  5. 23

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

25 records
  • CVE-2022-37190
    49Plan

    CuppaCMS 1.0 is vulnerable to Remote Code Execution (RCE).

    HighCVSS 8.8Proof of conceptEPSS 45%

    cuppacms · cuppacmsSep 13, 2022

  • CVE-2022-27984
    41Plan

    CuppaCMS v1.0 was discovered to contain a SQL injection vulnerability via the menu_filter parameter at /administrator/templates/default/html

    CriticalCVSS 9.8Proof of conceptEPSS 6%

    cuppacms · cuppacmsApr 26, 2022

  • CVE-2022-27985
    41Plan

    CuppaCMS v1.0 was discovered to contain a SQL injection vulnerability via /administrator/alerts/alertLightbox.php.

    CriticalCVSS 9.8Proof of conceptEPSS 6%

    cuppacms · cuppacmsApr 26, 2022

  • CVE-2022-38296
    40Plan

    Cuppa CMS v1.0 was discovered to contain an arbitrary file upload vulnerability via the File Manager.

    CriticalCVSS 9.8Proof of conceptEPSS 4%

    cuppacms · cuppacmsSep 12, 2022

  • CVE-2022-25498
    40Plan

    CuppaCMS v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the saveConfigData function in /classes/ajax/Functio

    CriticalCVSS 9.8No exploitEPSS 3%

    cuppacms · cuppacmsMar 15, 2022

  • CVE-2022-25495
    40Plan

    The component /jquery_file_upload/server/php/index.php of CuppaCMS v1.0 allows attackers to upload arbitrary files and execute arbitrary cod

    CriticalCVSS 9.8No exploitEPSS 2%

    cuppacms · cuppacmsMar 15, 2022

  • CVE-2023-39681
    40Plan

    Cuppa CMS v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the email_outgoing parameter at /Configuration.php.

    CriticalCVSS 9.8No exploitEPSS 1%

    cuppacms · cuppacmsSep 5, 2023

  • CVE-2018-19559
    39Monitor

    CuppaCMS before 2018-11-12 has SQL Injection in administrator/classes/ajax/functions.php via the reference_id parameter.

    CriticalCVSS 9.8No exploitEPSS 1%

    cuppacms · cuppacmsNov 26, 2018

  • CVE-2023-47990
    39Monitor

    SQL Injection vulnerability in components/table_manager/html/edit_admin_table.php in CuppaCMS V1.0 allows attackers to run arbitrary SQL com

    CriticalCVSS 9.8No exploitEPSS 0%

    cuppacms · cuppacmsDec 20, 2023

  • CVE-2020-26048
    36Monitor

    The file manager option in CuppaCMS before 2019-11-12 allows an authenticated attacker to upload a malicious file within an image extension

    HighCVSS 8.8No exploitEPSS 1%

    cuppacms · cuppacmsOct 5, 2020

  • CVE-2021-3376
    35Monitor

    An issue was discovered in Cuppa CMS Versions Before 31 Jan 2021 allows authenticated attackers to gain escalated privileges via a crafted P

    HighCVSS 8.8No exploitEPSS 1%

    cuppacms · cuppacmsDec 14, 2021

  • CVE-2021-29368
    35Monitor

    Session fixation vulnerability in CuppaCMS thru commit 4c9b742b23b924cf4c1f943f48b278e06a17e297 on November 12, 2019 allows attackers to gai

    HighCVSS 8.8No exploitEPSS 0%

    cuppacms · cuppacmsJan 20, 2023

  • CVE-2022-25486
    34Monitor

    CuppaCMS v1.0 was discovered to contain a local file inclusion via the url parameter in /alerts/alertConfigField.php.

    HighCVSS 7.8Proof of conceptEPSS 9%

    cuppacms · cuppacmsMar 15, 2022

  • CVE-2022-25485
    33Monitor

    CuppaCMS v1.0 was discovered to contain a local file inclusion via the url parameter in /alerts/alertLightbox.php.

    HighCVSS 7.8Proof of conceptEPSS 7%

    cuppacms · cuppacmsMar 15, 2022

  • CVE-2022-24264
    32Monitor

    Cuppa CMS v1.0 was discovered to contain a SQL injection vulnerability in /administrator/components/table_manager/ via the search_word param

    HighCVSS 7.5Proof of conceptEPSS 6%

    cuppacms · cuppacmsJan 31, 2022

  • CVE-2022-24265
    32Monitor

    Cuppa CMS v1.0 was discovered to contain a SQL injection vulnerability in /administrator/components/menu/ via the path=component/menu/&menu_

    HighCVSS 7.5Proof of conceptEPSS 6%

    cuppacms · cuppacmsJan 31, 2022

  • CVE-2022-24266
    32Monitor

    Cuppa CMS v1.0 was discovered to contain a SQL injection vulnerability in /administrator/components/table_manager/ via the order_by paramete

    HighCVSS 7.5Proof of conceptEPSS 5%

    cuppacms · cuppacmsJan 31, 2022

  • CVE-2022-24647
    32Monitor

    Cuppa CMS v1.0 was discovered to contain an arbitrary file deletion vulnerability via the unlink() function.

    HighCVSS 8.1No exploitEPSS 1%

    cuppacms · cuppacmsFeb 10, 2022

  • CVE-2022-34121
    31Monitor

    Cuppa CMS v1.0 was discovered to contain a local file inclusion (LFI) vulnerability via the component /templates/default/html/windows/right.

    HighCVSS 7.5Proof of conceptEPSS 3%

    cuppacms · cuppacmsJul 27, 2022

  • CVE-2022-25401
    31Monitor

    The copy function of the file manager in Cuppa CMS v1.0 allows any file to be copied to the current directory, granting attackers read acces

    HighCVSS 7.5No exploitEPSS 2%

    cuppacms · cuppacmsFeb 24, 2022

  • CVE-2022-37191
    27Monitor

    The component "cuppa/api/index.php" of CuppaCMS v1.0 is Vulnerable to LFI.

    MediumCVSS 6.5Proof of conceptEPSS 3%

    cuppacms · cuppacmsSep 13, 2022

  • CVE-2022-38295
    24Monitor

    Cuppa CMS v1.0 was discovered to contain a cross-site scripting vulnerability at /table_manager/view/cu_user_groups.

    MediumCVSS 6.1Proof of conceptEPSS 1%

    cuppacms · cuppacmsSep 12, 2022

  • CVE-2022-25497
    22Monitor

    CuppaCMS v1.0 was discovered to contain an arbitrary file read via the copy function.

    MediumCVSS 5.3Proof of conceptEPSS 3%

    cuppacms · cuppacmsMar 15, 2022

  • CVE-2018-19918
    21Monitor

    CuppaCMS has XSS via an SVG document uploaded to the administrator/#/component/table_manager/view/cu_views URI.

    MediumCVSS 5.4No exploitEPSS 0%

    cuppacms · cuppacmsDec 31, 2018

  • CVE-2018-17300
    19Monitor

    Stored XSS exists in CuppaCMS through 2018-09-03 via an administrator/#/component/table_manager/view/cu_menus section name.

    MediumCVSS 4.8No exploitEPSS 0%

    cuppacms · cuppacmsSep 21, 2018