B2evolution vulnerabilities

Products

• B2evolution 25
• Cms 4

Newest

• b2evolution cms b2evolution CMS 6.7.8 through 7.2.5 Object Injection via Negative Integer Array Key CVE-2026-76834 9.2 CriticalSeptember 17, 2026
• b2evolution b2evolution 7.2.2 - 'edit account details' Cross-Site Request Forgery (CSRF) CVE-2021-47800 6.9 MediumJanuary 15, 2026
• b2evolution cms RESERVED There is an arbitrary file upload vulnerability in b2evolution v7.2.5. Attackers can use... CVE-2022-44036 Disputed 7.2 HighJanuary 3, 2023
• b2evolution An authorization bypass in b2evolution allows remote, unauthenticated attackers to predict... CVE-2022-30935 9.1 CriticalSeptember 28, 2022
• b2evolution cms b2evolution CMS v7.2.3 was discovered to contain a SQL injection vulnerability via the parameter... CVE-2021-31632 9.8 CriticalDecember 6, 2021
• b2evolution cms b2evolution CMS v7.2.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the User... CVE-2021-31631 8.8 HighDecember 6, 2021
• b2evolution SQL Injection in the "evoadm.php" component of b2evolution v7.2.2-stable allows remote attackers... CVE-2021-28242 Public exploit 8.8 HighApril 15, 2021
• b2evolution cms Reflected cross-site scripting vulnerability (XSS) in the evoadm.php file in b2evolution cms... CVE-2020-22839 6.1 MediumFebruary 9, 2021
• b2evolution Stored XSS in b2evolution CMS version 6.11.6 and prior allows an attacker to perform malicious... CVE-2020-22841 Public exploit 4.8 MediumFebruary 9, 2021
• b2evolution Open redirect vulnerability in b2evolution CMS version prior to 6.11.6 allows an attacker to... CVE-2020-22840 EPSS 13.8% 6.1 MediumFebruary 9, 2021
• b2evolution b2evolution 6.7.6 suffer from an Object Injection vulnerability in /htsrv/call_plugin.php. CVE-2016-8901 9.8 CriticalMay 23, 2019
• b2evolution b2evolution version 6.6.0 - 6.8.10 is vulnerable to input validation (backslash and single quote... CVE-2017-1000423 9.8 CriticalJanuary 2, 2018
• b2evolution Cross-site scripting (XSS) vulnerability in plugins/markdown_plugin/_markdown.plugin.php in... CVE-2017-5553 5.4 MediumJanuary 23, 2017
• b2evolution The patch for directory traversal (CVE-2017-5480) in b2evolution version 6.8.4-stable has a... CVE-2017-5539 9.1 CriticalJanuary 23, 2017
• b2evolution Cross-site scripting (XSS) vulnerability in b2evolution 6.7.5 and earlier allows remote... CVE-2016-7150 5.4 MediumJanuary 18, 2017
• b2evolution Cross-site scripting (XSS) vulnerability in b2evolution 6.7.5 and earlier allows remote attackers... CVE-2016-7149 6.1 MediumJanuary 18, 2017
• b2evolution Multiple cross-site scripting (XSS) vulnerabilities in the file types table in b2evolution... CVE-2017-5494 5.4 MediumJanuary 15, 2017
• b2evolution Directory traversal vulnerability in inc/files/files.ctrl.php in b2evolution through 6.8.3 allows... CVE-2017-5480 8.1 HighJanuary 15, 2017
• b2evolution The "lost password" functionality in b2evolution before 6.7.9 allows remote attackers to reset... CVE-2016-9479 7.5 HighDecember 2, 2016
• b2evolution Cross-site scripting (XSS) vulnerability in the filemanager in b2evolution before 5.2.1 allows... CVE-2014-9599 4.3 MediumJanuary 16, 2015
• b2evolution Cross-site request forgery (CSRF) vulnerability in blogs/admin.php in b2evolution before 4.1.7... CVE-2013-7352 6.8 MediumApril 2, 2014
• b2evolution SQL injection vulnerability in blogs/admin.php in b2evolution before 4.1.7 allows remote... CVE-2013-2945 Public exploit 6.5 MediumApril 2, 2014
• b2evolution Cross-site scripting (XSS) vulnerability in blogs/blog1.php in b2evolution 4.1.3 allows remote... CVE-2012-5911 4.3 MediumNovember 17, 2012
• b2evolution SQL injection vulnerability in blogs/htsrv/viewfile.php in b2evolution 4.1.3 allows remote... CVE-2012-5910 6.5 MediumNovember 17, 2012
• b2evolution b2evolution 3.3.3 allows remote attackers to obtain sensitive information via a direct request to... CVE-2011-3709 5.0 MediumSeptember 23, 2011
• b2evolution starrating plugin Multiple SQL injection vulnerabilities in the Starrating plugin before 0.7.7 for b2evolution... CVE-2009-1657 7.5 HighMay 17, 2009
• b2evolution Directory traversal vulnerability in blogs/index.php in b2evolution 1.6 allows remote attackers... CVE-2007-2681 7.5 HighMay 15, 2007
• b2evolution ** DISPUTED ** Multiple PHP remote file inclusion vulnerabilities in b2evolution allow remote... CVE-2007-2358 Disputed 7.5 HighApril 30, 2007
• b2evolution Cross-site scripting (XSS) vulnerability in htsrv/login.php in b2evolution 1.8.6 allows remote... CVE-2007-0175 Fix available 4.3 MediumJanuary 11, 2007
• b2evolution PHP remote file inclusion vulnerability in inc/CONTROL/import/import-mt.php in b2evolution 1.8.5... CVE-2006-6417 Public exploit 7.5 HighDecember 10, 2006
• b2evolution Multiple cross-site scripting (XSS) vulnerabilities in b2evolution 1.8.2 through 1.9 beta allow... CVE-2006-6197 Public exploit 6.8 MediumDecember 1, 2006