Zikula Zikula Application Framework — known CVE vulnerabilities

Every CVE whose affected-product data names Zikula Zikula Application Framework, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (10)

• CVE-2014-2293 — CVSS 9.8 (critical): Zikula Application Framework before 1.3.7 build 11 allows remote attackers to conduct PHP object injection attacks and delete arbitrary…
• CVE-2016-9835 — CVSS 9.8 (critical): Directory traversal vulnerability in file "jcss.php" in Zikula 1.3.x before 1.3.11 and 1.4.x before 1.4.4 on Windows allows a remote…
• CVE-2010-4729 — CVSS 6.8 (medium): Zikula before 1.2.3 does not use the authid protection mechanism for (1) the lostpassword form and (2) mailpasswd processing, which makes…
• CVE-2011-0535 — CVSS 6.8 (medium): Cross-site request forgery (CSRF) vulnerability in the Users module in Zikula before 1.2.5 allows remote attackers to hijack the…
• CVE-2010-1732 — CVSS 6.8 (medium): Cross-site request forgery (CSRF) vulnerability in the users module in Zikula Application Framework before 1.2.3 allows remote attackers to…
• CVE-2010-4728 — CVSS 5.0 (medium): Zikula before 1.3.1 uses the rand and srand PHP functions for random number generation, which makes it easier for remote attackers to…
• CVE-2011-0911 — CVSS 4.3 (medium): Cross-site scripting (XSS) vulnerability in the Users module in Zikula before 1.2.5 allows remote attackers to inject arbitrary web script…
• CVE-2010-1724 — CVSS 4.3 (medium): Multiple cross-site scripting (XSS) vulnerabilities in Zikula Application Framework 1.2.2, and possibly earlier, allow remote attackers to…
• CVE-2011-3979 — CVSS 4.3 (medium): Cross-site scripting (XSS) vulnerability in ztemp/view_compiled/Theme/theme_admin_setasdefault.php in the theme module in Zikula…
• CVE-2013-6168 — CVSS 4.3 (medium): Cross-site scripting (XSS) vulnerability in Zikula Application Framework before 1.3.6 allows remote attackers to inject arbitrary web…