Approved changes feed: RSS · Atom
cpe:2.3:a:b3log:symphony:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | B3Log (86d16015-6676-51cc-958c-521884a67196) |
|---|---|
| Product | Symphony (7526d6f1-26fa-5297-96db-c3ac6fef1815) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/88250/symphony |
purl2cpe | 2026-06-01 10:11:23.476392 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-23049 |
vulnerable | 2026-06-08 06:29:36.190931 |
Details available
An issue in symphony v.3.6.3 and before allows a remote attacker to execute arbitrary code via the log4j component.
Published: 2024-02-05T00:00:00.000Z
Updated: 2025-06-17T19:47:55.650Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-9142 |
vulnerable | 2026-06-08 05:14:25.044175 |
Details available
An issue was discovered in b3log Symphony (aka Sym) before v3.4.7. XSS exists via the userIntro and userNickname fields to processor/SettingsProcessor.java.
Published: 2019-02-25T15:00:00.000Z
Updated: 2024-09-16T20:52:36.730Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-17488 |
vulnerable | 2026-06-08 05:13:10.535683 |
Details available
b3log Symphony (aka Sym) before 3.6.0 has XSS via the HTTP User-Agent header.
Published: 2019-10-10T20:18:00.000Z
Updated: 2024-08-05T01:40:15.851Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-16249 |
vulnerable | 2026-06-08 05:11:04.574030 |
Details available
In Symphony before 3.3.0, there is XSS in the Title under Post. The ID "articleTitle" of this is stored in the "articleTitle" JSON field, and executes a payload when accessing the /member/test/points URI, allowing remote attacks. Any Web script or HTML can be inserted by an admin-authenticated user via a crafted web site name.
Published: 2019-06-20T13:54:12.000Z
Updated: 2024-08-05T10:17:38.305Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.