Frogcms Project Frogcms — known CVE vulnerabilities

Every CVE whose affected-product data names Frogcms Project Frogcms, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (24)

• CVE-2021-26794 — CVSS 9.8 (critical): Privilege escalation in 'upload.php' in FrogCMS SentCMS v0.9.5 allows attacker to execute arbitrary code via crafted php file.
• CVE-2024-46394 — CVSS 8.8 (high): FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admin/?/user/add
• CVE-2024-42628 — CVSS 8.8 (high): FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/snippet/edit/3.
• CVE-2024-42629 — CVSS 8.8 (high): FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/page/edit/10.
• CVE-2024-42630 — CVSS 8.8 (high): FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/plugin/file_manager/create_file.
• CVE-2024-42631 — CVSS 8.8 (high): FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/layout/edit/1.
• CVE-2024-42632 — CVSS 8.8 (high): FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/page/add.
• CVE-2024-46085 — CVSS 8.8 (high): FrogCMS V0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/plugin/file_manager/rename
• CVE-2024-46086 — CVSS 8.8 (high): FrogCMS V0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/plugin/file_manager/delete/123
• CVE-2024-46362 — CVSS 8.8 (high): FrogCMS V0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/plugin/file_manager/create_directory
• CVE-2018-16447 — CVSS 8.8 (high): Frog CMS 0.9.5 has admin/?/user/edit/1 CSRF.
• CVE-2024-42623 — CVSS 8.8 (high): FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/layout/delete/1
• CVE-2024-42624 — CVSS 8.8 (high): FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/page/delete/10.
• CVE-2024-42625 — CVSS 8.8 (high): FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/layout/add
• CVE-2024-42626 — CVSS 8.8 (high): FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/snippet/add.
• CVE-2024-42627 — CVSS 8.8 (high): FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/snippet/delete/3.
• CVE-2018-10806 — CVSS 5.4 (medium): An issue was discovered in Frog CMS 0.9.5. There is a reflected Cross Site Scripting Vulnerability via the file[current_name] parameter to…
• CVE-2020-25872 — CVSS 4.9 (medium): A vulnerability exists within the FileManagerController.php function in FrogCMS 0.9.5 which allows an attacker to perform a directory…
• CVE-2018-10570 — CVSS 4.8 (medium): Frog CMS 0.9.5 has XSS in /install/index.php via the ['config']['admin_username'] field.
• CVE-2018-10318 — CVSS 4.8 (medium): Frog CMS 0.9.5 has XSS via the admin/?/page/edit page[keywords] parameter, aka Edit Page Metadata.
• CVE-2018-19844 — CVSS 4.8 (medium): FROG CMS 0.9.5 has XSS via the admin/?/snippet/add name parameter, which is mishandled during an edit action, a related issue to…
• CVE-2018-10320 — CVSS 4.8 (medium): Frog CMS 0.9.5 has XSS via the admin/?/layout/edit layout[name] parameter, aka Edit Layout.
• CVE-2018-10319 — CVSS 4.8 (medium): Frog CMS 0.9.5 has XSS via the admin/?/snippet/edit snippet[name] parameter, aka Edit Snippet.
• CVE-2018-10321 — CVSS 4.8 (medium): Frog CMS 0.9.5 has a stored Cross Site Scripting Vulnerability via "Admin Site title" in Settings.