Kodicms
Monthly
Code injection in KodiCMS (Kohana-based) up to version 13.82.135 exposes the Layout API endpoint to remote authenticated attackers who can manipulate the `content` argument of the `Save` function in `file.php` to inject and potentially execute arbitrary code server-side. A public proof-of-concept has been disclosed via VulDB (submission 718290), though EPSS sits at just 0.06% (19th percentile), indicating limited observed exploitation activity. No vendor patch exists - the vendor did not respond to coordinated disclosure - leaving deployed instances with no official remediation path.
SQL injection in KodiCMS (Kohana variant) up to version 13.82.135 allows remote low-privileged attackers to manipulate database queries through the `keyword` argument in the Search API Endpoint's `like` function. The vendor was notified but did not respond, leaving no official patch available. A public exploit exists, though EPSS probability sits at 0.04% (12th percentile), indicating minimal observed exploitation activity despite POC availability - no public exploit identified as confirmed actively exploited (CISA KEV).
Code injection in KodiCMS (Kohana-based) up to version 13.82.135 exposes the Layout API endpoint to remote authenticated attackers who can manipulate the `content` argument of the `Save` function in `file.php` to inject and potentially execute arbitrary code server-side. A public proof-of-concept has been disclosed via VulDB (submission 718290), though EPSS sits at just 0.06% (19th percentile), indicating limited observed exploitation activity. No vendor patch exists - the vendor did not respond to coordinated disclosure - leaving deployed instances with no official remediation path.
SQL injection in KodiCMS (Kohana variant) up to version 13.82.135 allows remote low-privileged attackers to manipulate database queries through the `keyword` argument in the Search API Endpoint's `like` function. The vendor was notified but did not respond, leaving no official patch available. A public exploit exists, though EPSS probability sits at 0.04% (12th percentile), indicating minimal observed exploitation activity despite POC availability - no public exploit identified as confirmed actively exploited (CISA KEV).