Skip to content
OpenAdvisories

Package · Packagist

thinkcmf/thinkcmf

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

5 results · Feed

  • Medium 5.4
    CVE-2020-25915

    ThinkCMF Cross-site Scripting Vulnerability

    Cross Site Scripting (XSS) vulnerability in UserController.php in ThinkCMF version 5.1.5, allows attackers to execute arbitrary code via crafted user_login.

    thinkcmf/thinkcmf Packagist
  • High 8.8
    CVE-2022-40489

    ThinkCMF Cross Site Request Forgery (CSRF) vulnerability

    ThinkCMF version 6.0.7 is affected by a Cross Site Request Forgery (CSRF) vulnerability that allows a Super Administrator user to be injected into administrative users.

    thinkcmf/thinkcmf Packagist
  • Medium 5.4
    CVE-2022-40849

    ThinkCMF Stored Cross-Site Scripting (XSS)

    ThinkCMF version 6.0.7 is affected by Stored Cross-Site Scripting (XSS). An attacker who successfully exploited this vulnerability could inject a Persistent XSS payload in the Slideshow Management section that execute arbitrary JavaScript code on the client s…

    thinkcmf/thinkcmf Packagist
  • Medium 6.5
    CVE-2021-40616

    Incorrect Authorization in thinkcmf

    thinkcmf v5.1.7 has an unauthorized vulnerability. The attacker can modify the password of the administrator account with id 1 through the background user management group permissions. The use condition is that the background user management group authority i…

    thinkcmf/thinkcmf Packagist
  • Medium 6.5
    CVE-2020-18151

    ThinkCMF Cross Site Request Forgerly (CSRF) vulnerability

    Cross Site Request Forgery (CSRF) vulnerability in ThinkCMF v5.1.0, which can add an admin account.

    thinkcmf/thinkcmf Packagist