onethink records
6 published records for vendor onethink.
Researcher profile
- Entered KEV
- 0 · 0%
- Weaponized
- 0 · 0%
- Pre-auth RCE
- 1
- With a fix record
- 0%
- Median publish → KEV
- No record has entered KEV
Recurring classes
- CWE-352 Cross-Site Request Forgery (CSRF)3
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')1
- CWE-918 Server-Side Request Forgery (SSRF)1
- CWE-94 Improper Control of Generation of Code ('Code Injection')1
The weakness classes this vendor ships most often: where to look.
CWEAttack profile
All records
6 records| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
40Plan | CVE-2017-14323No exploit | SSRF (Server Side Request Forgery) in getRemoteImage.php in Ueditor in Onethink V1.0 and V1.1 allows remote attackers to obtain sensitive inonethink · onethink · CWE-918 | Critical9.8 | — | 4.3% | Apr 10, 2018 |
39Monitor | CVE-2024-33444No exploit | SQL injection vulnerability in onethink v.1.1 allows a remote attacker to escalate privileges via a crafted script to the ModelModel.class.ponethink · onethink · CWE-89 | Critical9.8 | — | 0.8% | Apr 29, 2024 |
35Monitor | CVE-2018-15197No exploit | An issue was discovered in OneThink v1.1.onethink · onethink · CWE-352 | High8.8 | — | 0.6% | Aug 7, 2018 |
35Monitor | CVE-2018-15198No exploit | An issue was discovered in OneThink v1.1.onethink · onethink · CWE-352 | High8.8 | — | 0.6% | Aug 7, 2018 |
28Monitor | CVE-2024-33443No exploit | An issue in onethink v.1.1 allows a remote attacker to execute arbitrary code via a crafted script to the AddonsController.class.php componeonethink · onethink · CWE-94 | High7.1 | — | 0.7% | Apr 29, 2024 |
26Monitor | CVE-2018-16449No exploit | OneThink 1.1.141212 allows CSRF for adding a page via admin.php?s=/Channel/add.html, adding a blog via admin.php?s=/Article/update.html, andonethink · onethink · CWE-352 | Medium6.5 | — | 0.5% | Sep 4, 2018 |
- CVE-2017-1432340Plan
SSRF (Server Side Request Forgery) in getRemoteImage.php in Ueditor in Onethink V1.0 and V1.1 allows remote attackers to obtain sensitive in
CriticalCVSS 9.8No exploitEPSS 4%onethink · onethinkApr 10, 2018
- CVE-2024-3344439Monitor
SQL injection vulnerability in onethink v.1.1 allows a remote attacker to escalate privileges via a crafted script to the ModelModel.class.p
CriticalCVSS 9.8No exploitEPSS 0%onethink · onethinkApr 29, 2024
- CVE-2018-1519735Monitor
An issue was discovered in OneThink v1.1.
HighCVSS 8.8No exploitEPSS 0%onethink · onethinkAug 7, 2018
- CVE-2018-1519835Monitor
An issue was discovered in OneThink v1.1.
HighCVSS 8.8No exploitEPSS 0%onethink · onethinkAug 7, 2018
- CVE-2024-3344328Monitor
An issue in onethink v.1.1 allows a remote attacker to execute arbitrary code via a crafted script to the AddonsController.class.php compone
HighCVSS 7.1No exploitEPSS 0%onethink · onethinkApr 29, 2024
- CVE-2018-1644926Monitor
OneThink 1.1.141212 allows CSRF for adding a page via admin.php?s=/Channel/add.html, adding a blog via admin.php?s=/Article/update.html, and
MediumCVSS 6.5No exploitEPSS 0%onethink · onethinkSep 4, 2018