BigTree CMS BigTree CMS 4.2.23

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:bigtreecms:bigtree_cms:4.2.23:*:*:*:*:*:*:*

part: a version: 4.2.23 update: *

VendorBigtreecms (917f96dc-c690-5eb9-834b-61a4e4e6bbae)
ProductBigtree Cms (4cab417c-988c-581b-9596-82a63607ef01)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from NVD CPE 2.0 feed

PURL mappings

PURLSourceLast updated
pkg:bigtreecms/core purl2cpe 2026-06-01 10:18:15.184150
pkg:github/bigtreecms/bigtree-cms purl2cpe 2026-06-01 10:18:15.184156

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2018-18308 vulnerable 2026-06-08 05:11:07.411808 Details available
In the 4.2.23 version of BigTree, a Stored XSS vulnerability has been discovered in /admin/ajax/file-browser/upload/ (aka the image upload area).
Published: 2018-10-16T22:00:00.000Z
Updated: 2024-08-05T11:08:21.459Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2018-17341 vulnerable 2026-06-08 05:11:06.273495 Details available
BigTree 4.2.23 on Windows, when Advanced or Simple Rewrite routing is enabled, allows remote attackers to bypass authentication via a ..\ substring, as demonstrated by a launch.php?bigtree_htaccess_url=admin/images/..\ URI.
Published: 2018-09-23T05:00:00.000Z
Updated: 2024-09-16T19:14:18.575Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2018-17030 vulnerable 2026-06-08 05:11:05.867438 Details available
BigTree CMS 4.2.23 allows remote authenticated users, if possessing privileges to set hooks, to execute arbitrary code via /core/admin/auto-modules/forms/process.php.
Published: 2018-09-14T02:00:00.000Z
Updated: 2024-08-05T10:39:59.262Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.