CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2020-13443
https://notcve.org/view.php?id=CVE-2020-13443
ExpressionEngine before 5.3.2 allows remote attackers to upload and execute arbitrary code in a .php%20 file via Compose Msg, Add attachment, and Save As Draft actions. A user with low privileges (member) is able to upload this. It is possible to bypass the MIME type check and file-extension check while uploading new files. Short aliases are not used for an attachment; instead, direct access is allowed to the uploaded files. It is possible to upload PHP only if one has member access, or registration/forum is enabled and one can create a member with the default group id of 5. • https://expressionengine.com/blog https://gist.github.com/mariuszpoplwski/51604d8a6d7d78fffdf590c25e844e09 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2018-17874
https://notcve.org/view.php?id=CVE-2018-17874
ExpressionEngine before 4.3.5 has reflected XSS. ExpressionEngine en versiones anteriores a la 4.3.5 tiene Cross-Site Scripting (XSS) reflejado. • https://docs.expressionengine.com/latest/about/changelog.html#version-4-3-5 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2017-1000160
https://notcve.org/view.php?id=CVE-2017-1000160
EllisLab ExpressionEngine 3.4.2 is vulnerable to cross-site scripting resulting in PHP code injection EllisLab ExpressionEngine 3.4.2 es vulnerable a Cross-Site Scripting, lo que da lugar a una inyección de código PHP. • https://docs.expressionengine.com/latest/about/changelog.html#version-3-4-3 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 2%CPEs: 77EXPL: 0CVE-2017-0897
https://notcve.org/view.php?id=CVE-2017-0897
ExpressionEngine version 2.x < 2.11.8 and version 3.x < 3.5.5 create an object signing token with weak entropy. Successfully guessing the token can lead to remote code execution. ExpressionEngine, en versiones 2.x anteriores a la 2.11.8 y en versiones 3.x anteriores a la 3.5.5, crea un token de firma de objeto con una entropía débil. Si se adivina el token correctamente, puede conducir a la ejecución remota de código. • http://www.securityfocus.com/bid/99242 https://docs.expressionengine.com/latest/about/changelog.html#version-3-5-5 https://docs.expressionengine.com/v2/about/changelog.html#version-2-11-8 https://expressionengine.com/blog/expressionengine-3.5.5-and-2.11.8-released https://hackerone.com/reports/215890 • CWE-330: Use of Insufficiently Random Values CWE-331: Insufficient Entropy •
CVSS: 6.5EPSS: 0%CPEs: 30EXPL: 4CVE-2014-5387 – EllisLab ExpressionEngine Core SQL Injection
https://notcve.org/view.php?id=CVE-2014-5387
Multiple SQL injection vulnerabilities in EllisLab ExpressionEngine before 2.9.1 allow remote authenticated users to execute arbitrary SQL commands via the (1) column_filter or (2) category[] parameter to system/index.php or the (3) tbl_sort[0][] parameter in the comment module to system/index.php. Múltiples vulnerabilidades de inyección SQL en EllisLab ExpressionEngine anterior a 2.9.1 permite a usuarios remotos autenticados ejecutar comandos SQL arbitrarios a través del parámetro (1) column_filter o (2) category[] en system/index.php o el parámetro (3) tbl_sort[0][] en el módulo comment en system/index.php. EllisLab ExpressionEngine Core versions prior to 2.9.0 suffer from multiple authenticated remote SQL injection vulnerabilities. • http://packetstormsecurity.com/files/128946/EllisLab-ExpressionEngine-Core-SQL-Injection.html http://seclists.org/fulldisclosure/2014/Nov/2 http://www.securityfocus.com/bid/70875 https://ellislab.com/expressionengine/user-guide/about/changelog.html https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-5387 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •