Product:

Symphony

(Getsymphony)
Repositories https://github.com/symphonycms/symphony-2
#Vulnerabilities 17
Date Id Summary Products Score Patch Annotated
2020-08-11 CVE-2020-15071 content/content.blueprintsevents.php in Symphony CMS 3.0.0 allows XSS via fields['name'] to appendSubheading. Symphony 6.1
2020-10-07 CVE-2020-25343 Cross-site scripting (XSS) vulnerabilities in Symphony CMS 3.0.0 allow remote attackers to inject arbitrary web script or HTML to fields['body'] param via events\event.publish_article.php Symphony 5.4
2021-10-31 CVE-2020-25912 A XML External Entity (XXE) vulnerability was discovered in symphony\lib\toolkit\class.xmlelement.php in Symphony 2.7.10 which can lead to an information disclosure or denial of service (DOS). Symphony 9.1
2016-01-08 CVE-2015-8766 Multiple cross-site scripting (XSS) vulnerabilities in content/content.systempreferences.php in Symphony CMS before 2.6.4 allow remote attackers to inject arbitrary web script or HTML via the (1) email_sendmail[from_name], (2) email_sendmail[from_address], (3) email_smtp[from_name], (4) email_smtp[from_address], (5) email_smtp[host], (6) email_smtp[port], (7) jit_image_manipulation[trusted_external_sites], or (8) maintenance_mode[ip_whitelist] parameters to system/preferences. Symphony 6.1
2016-06-30 CVE-2016-4309 Session fixation vulnerability in Symphony CMS 2.6.7, when session.use_only_cookies is disabled, allows remote attackers to hijack web sessions via the PHPSESSID parameter. Symphony N/A
2017-04-11 CVE-2017-7694 Remote Code Execution vulnerability in symphony/content/content.blueprintsdatasources.php in Symphony CMS through 2.6.11 allows remote attackers to execute code and get a webshell from the back-end. The attacker must be authenticated and enter PHP code in the datasource editor or event editor. Symphony 8.8
2017-03-27 CVE-2017-6067 Symphony 2.6.9 has XSS in publish/notes/edit/##/saved/ via the bottom form field. Symphony 6.1
2017-01-20 CVE-2017-5542 Cross-site scripting (XSS) vulnerability in template/usererror.missing_extension.php in Symphony CMS before 2.6.10 allows remote attackers to inject arbitrary web script or HTML via the existing-folder parameter. Symphony 6.1
2017-01-20 CVE-2017-5541 Directory traversal vulnerability in template/usererror.missing_extension.php in Symphony CMS before 2.6.10 allows remote attackers to rename arbitrary files via a .. (dot dot) in the existing-folder and new-folder parameters. Symphony 5.3
2016-01-08 CVE-2015-8376 Multiple cross-site scripting (XSS) vulnerabilities in Symphony CMS 2.6.3 allow remote attackers to inject arbitrary web script or HTML via the (1) Name, (2) Navigation Group, or (3) Label parameter to blueprints/sections/edit/1. Symphony 6.1