İçeriğe atla
Noroxi

expressionengine kayıtları

expressionengine üreticisine ait 15 yayımlanmış kayıt.

Araştırmacı profili

KEV’e giren
0 · %0
Silahlaştırılmış
0 · %0
Pre-auth RCE
2
Düzeltme kaydı olan
%6,7
Yayından KEV’e ortanca
KEV’e giren kayıt yok

Yıllara göre kayıt

  1. 17
  2. 18
  3. 20
  4. 21
  5. 22
  6. 23
  7. 24
  8. 26

Çubuk: toplam · koyu kısım: CISA KEV.

Tekrar eden sınıflar

Bu üreticide en sık görülen zafiyet sınıfları: nereye bakmalı.

CWE

Saldırı profili

Bug bounty kapsamı

Ürünün üreticisi herkese açık bir programda görünüyor. Eşleşme ad üzerinden yapıldı; kapsam metnini programda doğrulayın.

Tüm kayıtlar

15 kayıt
  • CVE-2021-33199
    39İzleyin

    In Expression Engine before 6.0.3, addonIcon in Addons/file/mod.file.php relies on the untrusted input value of input->get('file') instead o

    KritikCVSS 9,8İstismar yokEPSS %1

    expressionengine · expressionengine12 Ağu 2021

  • CVE-2020-13443
    36İzleyin

    ExpressionEngine before 5.3.2 allows remote attackers to upload and execute arbitrary code in a .php%20 file via Compose Msg, Add attachment

    YüksekCVSS 8,8İstismar yokEPSS %4

    expressionengine · expressionengine24 Haz 2020

  • CVE-2021-27230
    36İzleyin

    ExpressionEngine before 5.4.2 and 6.x before 6.0.3 allows PHP Code Injection by certain authenticated users who can leverage Translate::save

    YüksekCVSS 8,8İstismar yokEPSS %3

    expressionengine · expressionengine15 Mar 2021

  • CVE-2023-22953
    35İzleyin

    In ExpressionEngine before 7.2.6, remote code execution can be achieved by an authenticated Control Panel user.

    YüksekCVSS 8,8İstismar yokEPSS %1

    expressionengine · expressionengine9 Şub 2023

  • CVE-2017-0897
    31İzleyin

    ExpressionEngine version 2.x < 2.11.8 and version 3.x < 3.5.5 create an object signing token with weak entropy.

    YüksekCVSS 7,5İstismar yokEPSS %4

    expressionengine · expressionengine22 Haz 2017

  • CVE-2020-8242
    28İzleyin

    Unsanitized user input in ExpressionEngine <= 5.4.0 control panel member creation leads to an SQL injection.

    YüksekCVSS 7,2İstismar yokEPSS %1

    expressionengine · expressionengine18 Şub 2022

  • CVE-2025-59473
    28İzleyin

    SQL Injection vulnerability in the Structure for Admin authenticated user

    YüksekCVSS 7,2İstismar yokEPSS %0

    expressionengine · expressionengine26 Oca 2026

  • CVE-2014-5387
    26İzleyin

    Multiple SQL injection vulnerabilities in EllisLab ExpressionEngine before 2.9.1 allow remote authenticated users to execute arbitrary SQL c

    OrtaCVSS 6,5İstismar yokEPSS %2

    ellislab · expressionengine4 Kas 2014

  • CVE-2021-44534
    26İzleyin

    Insufficient user input filtering leads to arbitrary file read by non-authenticated attacker, which results in sensitive information disclos

    OrtaCVSS 6,5İstismar yokEPSS %1

    expressionengine · expressionengine31 May 2024

  • CVE-2018-17874
    24İzleyin

    ExpressionEngine before 4.3.5 has reflected XSS.

    OrtaCVSS 6,1İstismar yokEPSS %1

    expressionengine · expressionengine1 Eki 2018

  • CVE-2024-38454
    24İzleyin

    ExpressionEngine before 7.4.11 allows XSS.

    OrtaCVSS 6,1İstismar yokEPSS %0

    expressionengine · expressionengine16 Haz 2024

  • CVE-2017-1000160
    21İzleyin

    EllisLab ExpressionEngine 3.4.2 is vulnerable to cross-site scripting resulting in PHP code injection

    OrtaCVSS 5,4İstismar yokEPSS %1

    expressionengine · expressionengine17 Kas 2017

  • CVE-2009-1070
    18İzleyin

    Cross-site scripting (XSS) vulnerability in system/index.php in ExpressionEngine 1.6.4 through 1.6.6, and possibly earlier versions, allows

    OrtaCVSS 4,3Kavram kanıtıEPSS %2

    expressionengine · expressionengine26 Mar 2009

  • CVE-2008-0201
    17İzleyin

    Cross-site scripting (XSS) vulnerability in index.php in ExpressionEngine 1.2.1 and earlier allows remote attackers to inject arbitrary web

    OrtaCVSS 4,3İstismar yokEPSS %1

    expressionengine · expressionengine9 Oca 2008

  • CVE-2008-0202
    17İzleyin

    CRLF injection vulnerability in index.php in ExpressionEngine 1.2.1 and earlier allows remote attackers to inject arbitrary HTTP headers and

    OrtaCVSS 4,3İstismar yokEPSS %1

    expressionengine · expressionengine9 Oca 2008