Zikula

2 CVEs product

Monthly

Sort: Newest CVSS Score EPSS Score Oldest

CVE-2016-9835 Dec 05, 08:59 CRITICAL PATCH Act Now

Directory traversal vulnerability in file "jcss.php" in Zikula 1.3.x before 1.3.11 and 1.4.x before 1.4.4 on Windows allows a remote attacker to launch a PHP object injection by uploading a. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Command Injection vulnerability could allow attackers to inject arbitrary commands into system command execution.

PHP Path Traversal Command Injection Microsoft Zikula Application Framework +1

NVD GitHub

CVSS 3.0

9.8

EPSS

3.9%

CVE-2013-6168 Nov 14, 20:55 MEDIUM POC PATCH This Month

Cross-site scripting (XSS) vulnerability in Zikula Application Framework before 1.3.6 allows remote attackers to inject arbitrary web script or HTML via the returnpage parameter to index.php. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available.

PHP XSS Zikula Application Framework Zikula

NVD

CVSS 2.0

4.3

EPSS

0.3%

CVE-2016-9835

EPSS 4% CVSS 9.8

CRITICAL PATCH Act Now

PHP Path Traversal Command Injection +3

NVD GitHub

CVE-2013-6168

EPSS 0% CVSS 4.3

MEDIUM POC PATCH This Month

PHP XSS Zikula Application Framework +1

NVD