📦

pligg_cms

Vendor: pligg

Login to add this product to WatchStack
Actively Exploited 0 CISA KEV List
PoC / Exploits 13 Code Available
Total RCEs 1 Remote Access
Total CVEs 753 Total Indexed
Avg. EPSS 1.19% Exploit Prob.
Latest CVE CVE-2024-42619 Aug 20

Security Vulnerability Index

Page 3 / 76
7.5 CVSS
CVE-2014-9096
Exploit Found

Multiple SQL injection vulnerabilities in recover.php in Pligg CMS 2.0.1 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id or (2) n parameter.

EPSS: 2.40%
7.5 CVSS
CVE-2012-2937

Multiple SQL injection vulnerabilities in Pligg CMS before 1.2.2 allow remote attackers to execute arbitrary SQL commands via the (1) list parameter in a move action to admin/admin_index.php, (2) display parameter in a minimize action to admin/admin_index.php, (3) enabled[] parameter to admin/admin_users.php, or (4) msg_id to the module.php in the simple_messaging module.

EPSS: 2.45%
4.3 CVSS
CVE-2012-2936

Multiple cross-site scripting (XSS) vulnerabilities in Pligg CMS before 1.2.2 allow remote attackers to inject arbitrary web script or HTML via the (1) user or (2) page parameter to (a) admin/admin_comments.php or (b) admin/admin_links.php; or list parameter in a (3) move or (4) minimize action to (c) admin/admin_index.php.

EPSS: 1.36%
4.3 CVSS
CVE-2012-2436
Exploit Found

Multiple cross-site scripting (XSS) vulnerabilities in Pligg CMS before 1.2.2 allow remote attackers to inject arbitrary web script or HTML via (1) an arbitrary parameter in a move or (2) minimize action to admin/admin_index.php; (3) the karma_username parameter to module.php in the karma module; (4) q_1_low, (5) q_1_high, (6) q_2_low, or (7) q_2_high parameter in a configure action to module.php in the captcha module; or (8) the edit parameter to module.php in the admin_language module.

EPSS: 2.53%
6.5 CVSS
CVE-2012-2435

Directory traversal vulnerability in the captcha module in Pligg CMS before 1.2.2 allows remote authenticated users to include and execute arbitrary local files via a .. (dot dot) in the captcha parameter to module.php, as demonstrated by cross-site request forgery (CSRF) attacks.

EPSS: 1.59%
4.3 CVSS
CVE-2011-5023
Exploit Found

Cross-site scripting (XSS) vulnerability in Pligg CMS 1.1.4 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to the search program, a different vulnerability than CVE-2011-3986.

EPSS: 1.61%
7.5 CVSS
CVE-2011-5022
Exploit Found

SQL injection vulnerability in search.php in Pligg CMS 1.1.2 allows remote attackers to execute arbitrary SQL commands via the status parameter.

EPSS: 1.01%
4.3 CVSS
CVE-2011-3986

Cross-site scripting (XSS) vulnerability in Pligg before 1.2.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

EPSS: 1.26%
5.0 CVSS
CVE-2011-3794

Pligg CMS 1.1.3 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by widgets/statistics/init.php and certain other files.

EPSS: 1.23%
7.5 CVSS
CVE-2010-3013

SQL injection vulnerability in groupadmin.php in Pligg before 1.1.1 allows remote attackers to execute arbitrary SQL commands via the role parameter, a different vulnerability than CVE-2010-2577.

EPSS: 1.26%