PatchTheCVEbycms vulnerabilities and fixes
Recent CVEs affecting bycms, with upgrade or downgrade steps. 3 tracked.
bycms has 3 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 0. Most recent: 2021-08-12. Highest priority: CVE-2020-18457 (score 39/100).
- CVE-2020-18457 MEDIUM 6.8 DOWNGRADE Cross Site Request Forgery (CSRF) vulnerability exists in bycms v1.3.0 that can add an admin account via admin
- CVE-2020-18455 MEDIUM 4.8 DOWNGRADE Cross Site Scripting (XSS) vulnerability exists in bycms v3.0.4 via the title parameter in the edit function i
- CVE-2020-18454 MEDIUM 6.8 DOWNGRADE Cross Site Request Forgery (CSRF) vulnerability in bycms v1.3 via admin.php/systems/index/module_id/70/group_i
FAQ
How do I fix bycms vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is bycms being exploited right now?
None of the tracked bycms CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which bycms CVE should I patch first?
CVE-2020-18457 currently ranks highest (39/100): Cross Site Request Forgery (CSRF) vulnerability exists in bycms v1.3.0 that can add an admin account via admin.