BlackCatDevelopment/BlackCatCMS

BlackCatDevelopment/BlackCatCMS

blackcat-cms.org

Releases25

Frequency4 months 2 weeks

Last Release over 3 years ago

Stars14

BlackCat CMS is a PHP5, HTML5 content management system

Log in to subscribe

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2020-25877 ↗	Jul 9, 2021Friday, 9 July 2021, 22:15	5.4 MEDIUM	3.5 LOW
A stored cross site scripting (XSS) vulnerability in the 'Add Page' feature of BlackCat CMS 1.3.6 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the 'Title' parameter.
CVE-2020-25878 ↗	Jul 9, 2021Friday, 9 July 2021, 22:15	4.8 MEDIUM	3.5 LOW
A stored cross site scripting (XSS) vulnerability in the 'Admin-Tools' feature of BlackCat CMS 1.3.6 allows authenticated attackers to execute arbitrary web scripts or HTML via crafted payloads entered into the 'Output Filters' and 'Droplets' modules.
CVE-2021-27237 ↗	Feb 16, 2021Tuesday, 16 February 2021, 19:15	4.8 MEDIUM	3.5 LOW
The admin panel in BlackCat CMS 1.3.6 allows stored XSS (by an admin) via the Display Name field to backend/preferences/ajax_save.php.
CVE-2020-25453 ↗	Sep 15, 2020Tuesday, 15 September 2020, 22:15	8.8 HIGH	6.8 MEDIUM
An issue was discovered in BlackCat CMS before 1.4. There is a CSRF vulnerability (bypass csrf_token) that allows remote arbitrary code execution.
CVE-2018-10821 ↗	Jun 14, 2018Thursday, 14 June 2018, 16:29	4.8 MEDIUM	3.5 LOW
Cross-site scripting (XSS) vulnerability in backend/pages/modify.php in BlackCatCMS 1.3 allows remote authenticated users with the Admin role to inject arbitrary web script or HTML via the search panel.
CVE-2017-9609 ↗	Jul 17, 2017Monday, 17 July 2017, 21:29	—	3.5 LOW
Cross-site scripting (XSS) vulnerability in Blackcat CMS 1.2 allows remote authenticated users to inject arbitrary web script or HTML via the map_language parameter to backend/pages/lang_settings.php.
CVE-2015-5521 ↗	Jul 14, 2015Tuesday, 14 July 2015, 16:59	4.8 MEDIUM	3.5 LOW
Cross-site scripting (XSS) vulnerability in BlackCat CMS 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the name in a new group to backend/groups/index.php.