thinkadmin records

9 published records for vendor thinkadmin.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 2
With a fix record: 22.2%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

9 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
53Plan	CVE-2020-25540Proof of concept	ThinkAdmin v6 is affected by a directory traversal vulnerability.thinkadmin · thinkadmin · CWE-22 Pre-auth Path traversal	High7.5	—	75.3%	Sep 14, 2020
40Plan	CVE-2020-23653No exploit	An insecure unserialize vulnerability was discovered in ThinkAdmin versions 4.x through 6.x in app/admin/controller/api/Update.php and app/wthinkadmin · thinkadmin · CWE-502 pre-auth RCE Deserialization	Critical9.8	—	4.1%	Jan 13, 2021
39Monitor	CVE-2019-11018No exploit	application\admin\controller\User.php in ThinkAdmin V4.0 does not prevent continued use of an administrator's cookie-based credentials afterthinkadmin · thinkadmin · CWE-287 Pre-auth Auth bypass	Critical9.8	—	1.4%	Apr 8, 2019
35Monitor	CVE-2023-48966No exploit	An arbitrary file upload vulnerability in the component /admin/api.upload/file of ThinkAdmin v6.1.53 allows attackers to execute arbitrary cthinkadmin · thinkadmin · CWE-434 RCE File upload	High8.8	—	1.1%	Dec 4, 2023
35Monitor	CVE-2023-48965No exploit	An issue in the component /admin/api.plugs/script of ThinkAdmin v6.1.53 allows attackers to getshell via providing a crafted URL to downloadthinkadmin · thinkadmin · CWE-434 File upload	High8.8	—	0.9%	Dec 4, 2023
31Monitor	CVE-2020-35296No exploit	ThinkAdmin v6 has default administrator credentials, which allows attackers to gain unrestricted administratior dashboard access.thinkadmin · thinkadmin · CWE-798 Pre-auth Hard-coded credentials	High7.5	—	2.2%	Mar 3, 2021
24Monitor	CVE-2023-34833No exploit	An arbitrary file upload vulnerability in the component /api/upload.php of ThinkAdmin v6 allows attackers to execute arbitrary code via a crthinkadmin · thinkadmin · CWE-434 pre-auth RCE File upload	Medium6.1	—	0.5%	Jun 15, 2023
21Monitor	CVE-2020-29315No exploit	ThinkAdmin version v1 v6 has a stored XSS vulnerability which allows remote attackers to inject an arbitrary web script or HTML.thinkadmin · thinkadmin · CWE-79 XSS	Medium5.4	—	1.0%	Dec 1, 2020
9Monitor	CVE-2024-10749No exploit	ThinkAdmin Plugs.php script deserializationthinkadmin · thinkadmin · CWE-502 Deserialization	Low2.3	—	0.5%	Nov 3, 2024

CVE-2020-25540
53Plan
ThinkAdmin v6 is affected by a directory traversal vulnerability.
HighCVSS 7.5Proof of conceptEPSS 75%
- Pre-auth
- Path traversal
thinkadmin · thinkadminSep 14, 2020
CVE-2020-23653
40Plan
An insecure unserialize vulnerability was discovered in ThinkAdmin versions 4.x through 6.x in app/admin/controller/api/Update.php and app/w
CriticalCVSS 9.8No exploitEPSS 4%
- pre-auth RCE
- Deserialization
thinkadmin · thinkadminJan 13, 2021
CVE-2019-11018
39Monitor
application\admin\controller\User.php in ThinkAdmin V4.0 does not prevent continued use of an administrator's cookie-based credentials after
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
- Auth bypass
thinkadmin · thinkadminApr 8, 2019
CVE-2023-48966
35Monitor
An arbitrary file upload vulnerability in the component /admin/api.upload/file of ThinkAdmin v6.1.53 allows attackers to execute arbitrary c
HighCVSS 8.8No exploitEPSS 1%
- RCE
- File upload
thinkadmin · thinkadminDec 4, 2023
CVE-2023-48965
35Monitor
An issue in the component /admin/api.plugs/script of ThinkAdmin v6.1.53 allows attackers to getshell via providing a crafted URL to download
HighCVSS 8.8No exploitEPSS 1%
- File upload
thinkadmin · thinkadminDec 4, 2023
CVE-2020-35296
31Monitor
ThinkAdmin v6 has default administrator credentials, which allows attackers to gain unrestricted administratior dashboard access.
HighCVSS 7.5No exploitEPSS 2%
- Pre-auth
- Hard-coded credentials
thinkadmin · thinkadminMar 3, 2021
CVE-2023-34833
24Monitor
An arbitrary file upload vulnerability in the component /api/upload.php of ThinkAdmin v6 allows attackers to execute arbitrary code via a cr
MediumCVSS 6.1No exploitEPSS 1%
- pre-auth RCE
- File upload
thinkadmin · thinkadminJun 15, 2023
CVE-2020-29315
21Monitor
ThinkAdmin version v1 v6 has a stored XSS vulnerability which allows remote attackers to inject an arbitrary web script or HTML.
MediumCVSS 5.4No exploitEPSS 1%
- XSS
thinkadmin · thinkadminDec 1, 2020
CVE-2024-10749
9Monitor
ThinkAdmin Plugs.php script deserialization
LowCVSS 2.3No exploitEPSS 1%
- Deserialization
thinkadmin · thinkadminNov 3, 2024