1000mz

Chestnutcms

8 vulnerabilities found.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
8.8

CVE-2025-5552

Exploit
  • EPSS 0.09%
  • Published 04.06.2025 02:00:18
  • Last modified 03.10.2025 01:04:38

A vulnerability was found in ChestnutCMS up to 15.1. It has been declared as critical. This vulnerability affects unknown code of the file /dev-api/groovy/exec of the component API Endpoint. The manipulation leads to deserialization. The attack can b...

7.5

CVE-2025-2917

Exploit
  • EPSS 0.09%
  • Published 28.03.2025 17:31:04
  • Last modified 09.06.2025 17:30:31

A vulnerability, which was classified as problematic, was found in ChestnutCMS up to 1.5.3. Affected is the function readFile of the file /dev-api/cms/file/read. The manipulation of the argument filePath leads to path traversal. It is possible to lau...

3.5

CVE-2025-2032

Exploit
  • EPSS 0.06%
  • Published 06.03.2025 17:15:24
  • Last modified 12.05.2025 20:43:29

A vulnerability classified as problematic was found in ChestnutCMS 1.5.2. This vulnerability affects the function renameFile of the file /cms/file/rename. The manipulation of the argument rename leads to path traversal. The exploit has been disclosed...

7.6

CVE-2025-2031

Exploit
  • EPSS 0.05%
  • Published 06.03.2025 16:15:55
  • Last modified 12.05.2025 20:56:38

A vulnerability classified as critical has been found in ChestnutCMS up to 1.5.2. This affects the function uploadFile of the file /dev-api/cms/file/upload. The manipulation of the argument file leads to unrestricted upload. It is possible to initiat...

7.5

CVE-2024-57451

Exploit
  • EPSS 0.35%
  • Published 03.02.2025 21:15:14
  • Last modified 13.05.2025 19:31:39

ChestnutCMS <=1.5.0 has a directory traversal vulnerability in contentcore.controller.FileController#getFileList, which allows attackers to view any directory.

9.8

CVE-2024-57450

Exploit
  • EPSS 0.32%
  • Published 03.02.2025 20:15:34
  • Last modified 13.05.2025 19:40:51

ChestnutCMS <=1.5.0 is vulnerable to File Upload via the Create template function.

7.5

CVE-2024-57452

Exploit
  • EPSS 0.11%
  • Published 03.02.2025 20:15:34
  • Last modified 13.05.2025 19:39:27

ChestnutCMS <=1.5.0 has an arbitrary file deletion vulnerability in contentcore.controller.FileController, which allows attackers to delete any file and folder.

9.8

CVE-2024-56828

Exploit
  • EPSS 0.13%
  • Published 06.01.2025 18:15:23
  • Last modified 21.04.2025 17:10:54

File Upload vulnerability in ChestnutCMS through 1.5.0. Based on the code analysis, it was determined that the /api/member/avatar API endpoint receives a base64 string as input. This string is then passed to the memberService.uploadAvatarByBase64 met...