GCVE - cpe:2.3:a:lepton-cms:lepton:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:lepton-cms:lepton:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Lepton Cms (`af013ec0-8664-5501-bb95-12a1190865ab`)
Product	Lepton (`0d047536-38e8-5d4c-a8ba-9cc8f0345987`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/lepton-project/lepton`	purl2cpe	2026-06-01 10:12:29.057327
`pkg:gitlab/lepton-project/lepton`	purl2cpe	2026-06-01 10:12:29.057330

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2024-29515`	vulnerable	2026-06-08 06:33:29.194665	Details available File Upload vulnerability in lepton v.7.1.0 allows a remote authenticated attackers to execute arbitrary code via uploading a crafted PHP file to the save.php and config.php component. Published: 2024-03-25T00:00:00.000Z Updated: 2024-08-19T19:56:31.080Z Open on db.gcve.eu Reference links https://github.com/zzq66/cve7/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-1000`	vulnerable	2026-06-08 05:00:46.943644	Details available Multiple cross-site scripting (XSS) vulnerabilities in LEPTON 1.1.3 and other versions before 1.1.4 allow remote attackers to inject arbitrary web script or HTML via the (1) message parameter to admins/login/forgot/index.php, or the (2) display_name or (3) email parameter to account/preferences.php. Published: 2012-02-20T19:00:00.000Z Updated: 2024-09-17T00:02:22.413Z Open on db.gcve.eu Reference links http://www.lepton-cms.org/media/changelog/changelog_1.1.4.txt http://www.lepton-cms.org/posts/security-release-lepton-1.1.4-52.php https://www.htbridge.ch/advisory/HTB23072	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-0999`	vulnerable	2026-06-08 05:00:46.830801	Details available SQL injection vulnerability in modules/news/rss.php in LEPTON before 1.1.4 allows remote attackers to execute arbitrary SQL commands via the group_id parameter. Published: 2012-02-20T19:00:00.000Z Updated: 2024-09-16T22:19:45.196Z Open on db.gcve.eu Reference links http://www.lepton-cms.org/media/changelog/changelog_1.1.4.txt http://www.lepton-cms.org/posts/security-release-lepton-1.1.4-52.php https://www.htbridge.ch/advisory/HTB23072	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-0998`	vulnerable	2026-06-08 05:00:46.828636	Details available Directory traversal vulnerability in account/preferences.php in LEPTON before 1.1.4 allows remote attackers to include and execute arbitrary files via a .. (dot dot) in the language parameter. Published: 2012-02-20T19:00:00.000Z Updated: 2024-09-16T23:40:39.011Z Open on db.gcve.eu Reference links http://www.lepton-cms.org/media/changelog/changelog_1.1.4.txt http://www.lepton-cms.org/posts/security-release-lepton-1.1.4-52.php https://www.htbridge.ch/advisory/HTB23072	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-3385`	vulnerable	2026-06-08 04:59:25.266220	Details available Cross-site scripting (XSS) vulnerability in WebsiteBaker before 2.8, as used in LEPTON and possibly other products, allows remote attackers to inject arbitrary web script or HTML via unknown vectors, a different vulnerability than CVE-2006-2307. Published: 2011-09-02T17:00:00.000Z Updated: 2024-09-17T01:20:46.355Z Open on db.gcve.eu Reference links http://jvn.jp/en/jp/JVN02134508/index.html http://jvndb.jvn.jp/en/contents/2011/JVNDB-2011-000067.html	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.