getsymphony

Top products

The 15 most recently published vulnerabilities affecting getsymphony.

• CVE-2020-25912A XML External Entity (XXE) vulnerability was discovered in symphony\lib\toolkit\class.xmlelement.php in Symphony 2.7.10 which can lead to an information disclosure or denial of service (DOS).9.1Oct 31, 2021
• CVE-2020-25343Cross-site scripting (XSS) vulnerabilities in Symphony CMS 3.0.0 allow remote attackers to inject arbitrary web script or HTML to fields['body'] param via events\event.publish_article.php5.4Oct 7, 2020
• CVE-2020-15071content/content.blueprintsevents.php in Symphony CMS 3.0.0 allows XSS via fields['name'] to appendSubheading.6.1Aug 11, 2020
• CVE-2018-12043content/content.blueprintspages.php in Symphony 2.7.6 has XSS via the pages content page.6.1Jun 7, 2018
• CVE-2017-8876Symphony 2 2.6.11 has XSS in the meta[navigation_group] parameter to content/content.blueprintssections.php.6.1May 10, 2017
• CVE-2017-7694Remote Code Execution vulnerability in symphony/content/content.blueprintsdatasources.php in Symphony CMS through 2.6.11 allows remote attackers to execute code and get a webshell from the back-end...8.8Apr 11, 2017
• CVE-2017-6067Symphony 2.6.9 has XSS in publish/notes/edit/##/saved/ via the bottom form field.6.1Mar 27, 2017
• CVE-2017-5541Directory traversal vulnerability in template/usererror.missing_extension.php in Symphony CMS before 2.6.10 allows remote attackers to rename arbitrary files via a .. (dot dot) in the existing-fold...5.3Jan 20, 2017
• CVE-2017-5542Cross-site scripting (XSS) vulnerability in template/usererror.missing_extension.php in Symphony CMS before 2.6.10 allows remote attackers to inject arbitrary web script or HTML via the existing-fo...6.1Jan 20, 2017
• CVE-2016-4309Session fixation vulnerability in Symphony CMS 2.6.7, when session.use_only_cookies is disabled, allows remote attackers to hijack web sessions via the PHPSESSID parameter.7.5Jun 30, 2016
• CVE-2015-8766Multiple cross-site scripting (XSS) vulnerabilities in content/content.systempreferences.php in Symphony CMS before 2.6.4 allow remote attackers to inject arbitrary web script or HTML via the (1) e...6.1Jan 8, 2016
• CVE-2015-8376Multiple cross-site scripting (XSS) vulnerabilities in Symphony CMS 2.6.3 allow remote attackers to inject arbitrary web script or HTML via the (1) Name, (2) Navigation Group, or (3) Label paramete...6.1Jan 8, 2016
• CVE-2015-4661Cross-site scripting (XSS) vulnerability in Symphony CMS 2.6.2 allows remote attackers to inject arbitrary web script or HTML via the sort parameter to system/authors.4.3Jun 18, 2015
• CVE-2013-2559SQL injection vulnerability in Symphony CMS before 2.3.2 allows remote authenticated users to execute arbitrary SQL commands via the sort parameter to system/authors/. NOTE: this can be leveraged ...6.5Mar 27, 2014
• CVE-2013-7346Cross-site request forgery (CSRF) vulnerability in Symphony CMS before 2.3.2 allows remote attackers to hijack the authentication of administrators for requests that conduct SQL injection attacks v...6.8Mar 27, 2014