Skip to content
OpenAdvisories

Package · Packagist

tribalsystems/zenario

22 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

14 results · Clear filters · Feed

  • Medium 4.8
    CVE-2024-45964

    Zenario Cross Site Scripting in the Image library

    Zenario 9.7.61188 is vulnerable to Cross Site Scripting (XSS) in the Image library via the "Organizer tags" field.

    tribalsystems/zenario Packagist
  • Medium 4.8
    CVE-2024-45960

    Zenario allows authenticated admin users to upload PDF files containing malicious code

    Zenario 9.7.61188 allows authenticated admin users to upload PDF files containing malicious code into the target system. If the PDF file is accessed through the website, it can trigger a Cross Site Scripting (XSS) attack.

    tribalsystems/zenario Packagist
  • Medium 6.5
    CVE-2024-34460

    Zenario's Tree Explorer tool from Organizer affected by Cross-site Scripting

    The Tree Explorer tool from Organizer in Zenario before 9.5.60602 is affected by XSS. (This component was removed in 9.5.60602.)

    tribalsystems/zenario Packagist
  • Medium 5.4
    CVE-2023-44769 Public exploit

    Zenario CMS Cross-site Scripting vulnerability

    A Cross-Site Scripting (XSS) vulnerability in Zenario CMS v.9.4.59197 allows a local attacker to execute arbitrary code via a crafted script to the Spare aliases from Alias.

    tribalsystems/zenario Packagist
  • Medium 5.4
    CVE-2023-44770 Public exploit

    Zenario CMS Cross-site Scripting vulnerability

    A Cross-Site Scripting (XSS) vulnerability in Zenario CMS v.9.4.59197 allows an attacker to execute arbitrary code via a crafted script to the Organizer - Spare alias.

    tribalsystems/zenario Packagist
  • Medium 5.4
    CVE-2023-44771 Public exploit

    Zenario CMS Cross-site Scripting vulnerability

    A Cross-Site Scripting (XSS) vulnerability in Zenario CMS v.9.4.59197 allows a local attacker to execute arbitrary code via a crafted script to the Page Layout.

    tribalsystems/zenario Packagist
  • Medium 4.2
    CVE-2022-4231

    Tribal Systems Zenario CMS Remember Me session fixiation

    A vulnerability, which was classified as problematic, has been found in Tribal Systems Zenario CMS 9.3.57595. This issue affects some unknown processing of the component Remember Me Handler. The manipulation leads to session fixiation. The attack may be initi…

    Tribal Systems Zenario CMS tribalsystems/zenario Packagist
  • Medium 5.4
    CVE-2022-44071

    Cross-site Scripting in Zenario

    Zenario CMS 9.3.57186 is is vulnerable to Cross Site Scripting (XSS) via profile.

    tribalsystems/zenario Packagist
  • Medium 5.4
    CVE-2022-44070

    Cross-site Scripting in Zenario

    Zenario CMS 9.3.57186 is vulnerable to Cross Site Scripting (XSS) via News articles.

    tribalsystems/zenario Packagist
  • Medium 5.4
    CVE-2022-44073

    Cross-site Scripting in Zenario

    Zenario CMS 9.3.57186 is vulnerable to Cross Site Scripting (XSS) via svg,Users & Contacts.

    tribalsystems/zenario Packagist
  • Medium 5.4
    CVE-2022-44069

    Cross-site Scripting in Zenario

    Zenario CMS 9.3.57186 is vulnerable to Cross Site Scripting (XSS) via the Nest library module.

    tribalsystems/zenario Packagist
  • Medium 4.8
    CVE-2021-41952

    Cross-site Scripting in Zenario CMS

    Zenario CMS 9.0.54156 is vulnerable to Cross Site Scripting (XSS) via upload file to *.SVG. An attacker can send malicious files to victims and steals victim's cookie leads to account takeover. The person viewing the image of a contact can be victim of XSS.

    tribalsystems/zenario Packagist
  • Medium 4.8
    CVE-2021-27673

    reflected XSS in tribalsystems/zenario

    Cross Site Scripting (XSS) in the "admin_boxes.ajax.php" component of Tribal Systems Zenario CMS v8.8.52729 allows remote attackers to execute arbitrary code by injecting arbitrary HTML into the "cID" parameter when creating a new HTML component.

    tribalsystems/zenario Packagist
  • Medium 4.9
    CVE-2021-27672

    SQL Injection in tribalsystems/zenario

    SQL Injection in the "admin_boxes.ajax.php" component of Tribal Systems Zenario CMS v8.8.52729 allows remote attackers to obtain sesnitive database information by injecting SQL commands into the "cID" parameter when creating a new HTML component.

    tribalsystems/zenario Packagist