GCVE - cpe:2.3:a:efrontlearning:efront:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:efrontlearning:efront:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Efrontlearning (`0c47eade-dc33-5531-97a8-f599c253c1da`)
Product	Efront (`77ee7a69-c3c8-5d32-a3e5-2c9279812851`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/caernel/efront_open_source`	purl2cpe	2026-06-01 10:16:57.947258
`pkg:github/cmonterrosa/efront`	purl2cpe	2026-06-01 10:16:57.947261

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2015-4463`	vulnerable	2026-06-08 05:06:39.900250	Details available The file_manager component in eFront CMS before 3.6.15.5 allows remote authenticated users to bypass intended file-upload restrictions by appending a crafted parameter to the file URL. Published: 2017-07-25T18:00:00.000Z Updated: 2024-08-06T06:18:11.061Z Open on db.gcve.eu Reference links http://mohankallepalli.blogspot.in/2015/05/eFront-cms-multiple-bugs.html http://forum.efrontlearning.net/viewtopic.php?f=15&t=9841	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-4462`	vulnerable	2026-06-08 05:06:39.899952	Details available Absolute path traversal vulnerability in the file_manager component of eFront CMS before 3.6.15.5 allows remote authenticated users to read arbitrary files via a full pathname in the "Upload file from url" field in the file manager for professor.php. Published: 2017-07-25T18:00:00.000Z Updated: 2024-08-06T06:18:11.059Z Open on db.gcve.eu Reference links http://mohankallepalli.blogspot.in/2015/05/eFront-cms-multiple-bugs.html http://forum.efrontlearning.net/viewtopic.php?f=15&t=9841	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-4461`	vulnerable	2026-06-08 05:06:39.899578	Details available Absolute path traversal vulnerability in eFront CMS 3.6.15.4 and earlier allows remote Professor users to obtain sensitive information via a full pathname in the other parameter. Published: 2018-02-05T16:00:00.000Z Updated: 2024-08-06T06:18:10.578Z Open on db.gcve.eu Reference links http://forum.efrontlearning.net/viewtopic.php?f=15&t=9841 https://mohankallepalli.blogspot.in/2015/05/eFront-cms-multiple-bugs.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2010-1918`	vulnerable	2026-06-08 04:54:10.979440	Details available SQL injection vulnerability in ask_chat.php in eFront 3.6.2 and earlier allows remote attackers to execute arbitrary SQL commands via the chatrooms_ID parameter. Published: 2010-05-12T00:00:00.000Z Updated: 2024-09-17T03:55:09.567Z Open on db.gcve.eu Reference links http://secunia.com/advisories/39728 http://packetstormsecurity.org/1005-exploits/MOPS-2010-018.pdf http://www.securityfocus.com/bid/40032 http://www.php-security.org/2010/05/09/mops-2010-018-efront-ask_chat-chatrooms_id-sql-injection-vulnerability/index.html http://osvdb.org/64506	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2009-3660`	vulnerable	2026-06-08 04:51:43.544422	Details available PHP remote file inclusion vulnerability in libraries/database.php in Efront 3.5.4 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the path parameter. NOTE: this is only a vulnerability when the administrator does not follow recommendations in the product's security documentation. Published: 2009-10-11T22:00:00.000Z Updated: 2024-08-07T06:38:30.094Z Open on db.gcve.eu Reference links http://forum.efrontlearning.net/viewtopic.php?f=1&t=1354&p=7174#p7174 http://www.exploit-db.com/exploits/9681 http://www.securityfocus.com/bid/36411	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2008-7026`	vulnerable	2026-06-08 04:51:05.455089	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.