Frog Cms Project Frog Cms — known CVE vulnerabilities

Every CVE whose affected-product data names Frog Cms Project Frog Cms, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (18)

• CVE-2014-4912 — CVSS 9.8 (critical): An Arbitrary File Upload issue was discovered in Frog CMS 0.9.5 due to lack of extension validation.
• CVE-2018-8908 — CVSS 8.8 (high): An issue was discovered in /admin/?/user/add in Frog CMS 0.9.5. The application's add user functionality suffers from CSRF. A malicious…
• CVE-2018-20776 — CVSS 7.5 (high): Frog CMS 0.9.5 provides a directory listing for a /public request.
• CVE-2018-20775 — CVSS 7.2 (high): admin/?/plugin/file_manager in Frog CMS 0.9.5 allows PHP code execution by creating a new .php file containing PHP code, and then visiting…
• CVE-2018-11098 — CVSS 7.2 (high): An issue was discovered in Frog CMS 0.9.5. There is a file upload vulnerability via the admin/?/plugin/file_manager/upload URI, a similar…
• CVE-2018-20772 — CVSS 7.2 (high): Frog CMS 0.9.5 allows PHP code execution via <?php to the admin/?/layout/edit/1 URI.
• CVE-2018-20773 — CVSS 7.2 (high): Frog CMS 0.9.5 allows PHP code execution by visiting admin/?/page/edit/1 and inserting additional <?php lines.
• CVE-2019-6243 — CVSS 6.1 (medium): Frog CMS 0.9.5 allows XSS via the forgot password page (aka the /admin/?/login/forgot URI).
• CVE-2018-20778 — CVSS 6.1 (medium): admin/?/plugin/file_manager in Frog CMS 0.9.5 allows XSS by creating a new file containing a crafted attribute of an IMG element.
• CVE-2018-20448 — CVSS 5.4 (medium): Frog CMS 0.9.5 has XSS via the Database name field to the /install/index.php URI.
• CVE-2018-20777 — CVSS 5.4 (medium): Frog CMS 0.9.5 has XSS via the admin/?/snippet/edit/1 Body field.
• CVE-2019-1010235 — CVSS 5.4 (medium): Frog CMS 1.1 is affected by: Cross Site Scripting (XSS). The impact is: Cookie stealing, Alert pop-up on page, Redirecting to another…
• CVE-2018-20774 — CVSS 5.4 (medium): Frog CMS 0.9.5 has XSS via the admin/?/layout/edit/1 Body field.
• CVE-2018-16373 — CVSS 4.9 (medium): Frog CMS 0.9.5 has an Upload vulnerability that can create files via /admin/?/plugin/file_manager/save.
• CVE-2018-9991 — CVSS 4.8 (medium): Frog CMS 0.9.5 has XSS via the /admin/?/user/add Name or Username parameter.
• CVE-2018-16374 — CVSS 4.8 (medium): Frog CMS 0.9.5 has stored XSS via /admin/?/plugin/comment/settings.
• CVE-2018-9992 — CVSS 4.8 (medium): Frog CMS 0.9.5 has XSS via the name field of a new "File" or "Directory" on the admin/?/plugin/file_manager/browse/ screen.
• CVE-2018-20680 — CVSS 4.8 (medium): Frog CMS 0.9.5 has XSS in the admin/?/page/edit/1 body field.