xwlrbh/Catfish

xwlrbh/Catfish

Releases0

Stars10

Catfish CMS

Log in to subscribe

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2020-18409 ↗	Jun 27, 2023Tuesday, 27 June 2023, 21:15	6.8 MEDIUM	—
Cross Site Request Forgery (CSRF) vulnerability was discovered in CatfishCMS 4.8.63 that would allow attackers to obtain administrator permissions via /index.php/admin/index/modifymanage.html.
CVE-2021-45017 ↗	Dec 15, 2021Wednesday, 15 December 2021, 23:15	8.8 HIGH	6.8 MEDIUM
Cross Site Request Forgery (CSRF) vulnerability exits in Catfish <=6.1.* when you upload an html file containing CSRF on the website that uses a google editor; you can specify the menu url address as your malicious url address in the Add Menu column.
CVE-2021-45018 ↗	Dec 15, 2021Wednesday, 15 December 2021, 23:15	6.1 MEDIUM	4.3 MEDIUM
Cross Site Scripting (XSS) vulnerability exists in Catfish <=6.3.0 via a Google search in url:/catfishcms/index.php/admin/Index/addmenu.htmland then the .html file on the website that uses this editor (the file suffix is allowed).
CVE-2020-23962 ↗	Jun 23, 2021Wednesday, 23 June 2021, 19:15	6.1 MEDIUM	4.3 MEDIUM
A cross site scripting (XSS) vulnerability in Catfish CMS 4.9.90 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "announcement_gonggao" parameter.
CVE-2018-13999 ↗	Jul 12, 2018Thursday, 12 July 2018, 12:29	—	3.5 LOW
Catfish CMS v4.7.9 allows XSS via the admin/Index/write.html editorValue parameter (aka an article posted by an administrator).
CVE-2018-10023 ↗	Apr 11, 2018Wednesday, 11 April 2018, 17:29	—	3.5 LOW
Catfish CMS V4.7.21 allows XSS via the pinglun parameter to cat/index/index/pinglun (aka an authenticated comment).