frog cms project vulnerabilities

Products

• frog cms 19

Latest frog cms project CVEs

Newest publication first

1. CVE-2024-42630 FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/plugin/file_manager/create_file.

   Published 2024-08-12

   High·CVSS 8.8

   FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/plugin/file_manager/create_file.

2. CVE-2019-1010235 Frog CMS 1.1 is affected by: Cross Site Scripting (XSS). The impact is: Cookie stealing, Alert pop-up on page, Redirecting to another phishing site, Executing browser exploits. The component is: Snipp...

   Published 2019-07-22

   Medium·CVSS 5.4

   Frog CMS 1.1 is affected by: Cross Site Scripting (XSS). The impact is: Cookie stealing, Alert pop-up on page, Redirecting to another phishing site, Executing browser exploits. The component is: Snippets.

3. CVE-2018-20778 admin/?/plugin/file_manager in Frog CMS 0.9.5 allows XSS by creating a new file containing a crafted attribute of an IMG element.

   Published 2019-02-11

   Medium·CVSS 6.1

   admin/?/plugin/file_manager in Frog CMS 0.9.5 allows XSS by creating a new file containing a crafted attribute of an IMG element.

4. CVE-2018-20777 Frog CMS 0.9.5 has XSS via the admin/?/snippet/edit/1 Body field.

   Published 2019-02-11

   Medium·CVSS 5.4

   Frog CMS 0.9.5 has XSS via the admin/?/snippet/edit/1 Body field.

5. CVE-2018-20776 Frog CMS 0.9.5 provides a directory listing for a /public request.

   Published 2019-02-11

   High·CVSS 7.5

   Frog CMS 0.9.5 provides a directory listing for a /public request.

6. CVE-2018-20775 admin/?/plugin/file_manager in Frog CMS 0.9.5 allows PHP code execution by creating a new .php file containing PHP code, and then visiting this file under the public/ URI.

   Published 2019-02-11

   High·CVSS 7.2

   admin/?/plugin/file_manager in Frog CMS 0.9.5 allows PHP code execution by creating a new .php file containing PHP code, and then visiting this file under the public/ URI.

7. CVE-2018-20774 Frog CMS 0.9.5 has XSS via the admin/?/layout/edit/1 Body field.

   Published 2019-02-11

   Medium·CVSS 5.4

   Frog CMS 0.9.5 has XSS via the admin/?/layout/edit/1 Body field.

8. CVE-2018-20773 Frog CMS 0.9.5 allows PHP code execution by visiting admin/?/page/edit/1 and inserting additional <?php lines.

   Published 2019-02-11

   High·CVSS 7.2

   Frog CMS 0.9.5 allows PHP code execution by visiting admin/?/page/edit/1 and inserting additional <?php lines.

9. CVE-2018-20772 Frog CMS 0.9.5 allows PHP code execution via <?php to the admin/?/layout/edit/1 URI.

   Published 2019-02-11

   High·CVSS 7.2

   Frog CMS 0.9.5 allows PHP code execution via <?php to the admin/?/layout/edit/1 URI.

10. CVE-2019-6243 Frog CMS 0.9.5 allows XSS via the forgot password page (aka the /admin/?/login/forgot URI).

    Published 2019-01-12

    Medium·CVSS 6.1

    Frog CMS 0.9.5 allows XSS via the forgot password page (aka the /admin/?/login/forgot URI).

11. CVE-2018-20680 Frog CMS 0.9.5 has XSS in the admin/?/page/edit/1 body field.

    Published 2019-01-09

    Medium·CVSS 4.8

    Frog CMS 0.9.5 has XSS in the admin/?/page/edit/1 body field.

12. CVE-2018-20448 Frog CMS 0.9.5 has XSS via the Database name field to the /install/index.php URI.

    Published 2018-12-25

    Medium·CVSS 5.4 EPSS 1.7%

    Frog CMS 0.9.5 has XSS via the Database name field to the /install/index.php URI.

13. CVE-2018-16374 Frog CMS 0.9.5 has stored XSS via /admin/?/plugin/comment/settings.

    Published 2018-09-03

    Medium·CVSS 4.8

    Frog CMS 0.9.5 has stored XSS via /admin/?/plugin/comment/settings.

14. CVE-2018-16373 Frog CMS 0.9.5 has an Upload vulnerability that can create files via /admin/?/plugin/file_manager/save.

    Published 2018-09-03

    Medium·CVSS 4.9

    Frog CMS 0.9.5 has an Upload vulnerability that can create files via /admin/?/plugin/file_manager/save.

15. CVE-2018-11098 An issue was discovered in Frog CMS 0.9.5. There is a file upload vulnerability via the admin/?/plugin/file_manager/upload URI, a similar issue to CVE-2014-4912.

    Published 2018-05-15

    High·CVSS 7.2

    An issue was discovered in Frog CMS 0.9.5. There is a file upload vulnerability via the admin/?/plugin/file_manager/upload URI, a similar issue to CVE-2014-4912.

16. CVE-2018-9992 Frog CMS 0.9.5 has XSS via the name field of a new "File" or "Directory" on the admin/?/plugin/file_manager/browse/ screen.

    Published 2018-04-11

    Medium·CVSS 4.8

    Frog CMS 0.9.5 has XSS via the name field of a new "File" or "Directory" on the admin/?/plugin/file_manager/browse/ screen.

17. CVE-2018-9991 Frog CMS 0.9.5 has XSS via the /admin/?/user/add Name or Username parameter.

    Published 2018-04-11

    Medium·CVSS 4.8

    Frog CMS 0.9.5 has XSS via the /admin/?/user/add Name or Username parameter.

18. CVE-2018-8908 An issue was discovered in /admin/?/user/add in Frog CMS 0.9.5. The application's add user functionality suffers from CSRF. A malicious user can craft an HTML page and use it to trick a victim into cl...

    Published 2018-03-31

    High·CVSS 8.8 EPSS 2.2%

    An issue was discovered in /admin/?/user/add in Frog CMS 0.9.5. The application's add user functionality suffers from CSRF. A malicious user can craft an HTML page and use it to trick a victim into clicking on it; once executed, a malicious user will be created with admin privile...

19. CVE-2014-4912 An Arbitrary File Upload issue was discovered in Frog CMS 0.9.5 due to lack of extension validation.

    Published 2018-03-22

    Critical·CVSS 9.8 EPSS 8.1%

    An Arbitrary File Upload issue was discovered in Frog CMS 0.9.5 due to lack of extension validation.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.