PatchTheCVEdbhcms vulnerabilities and fixes
Recent CVEs affecting dbhcms, with upgrade or downgrade steps. 15 tracked.
dbhcms has 15 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 0. Most recent: 2020-08-24. Highest priority: CVE-2020-19878 (score 55/100).
- CVE-2020-19891 HIGH 7.2 DOWNGRADE DBHcms v1.2.0 has an Arbitrary file write vulnerability in dbhcms\mod\mod.editor.php $_POST['updatefile'] is f
- CVE-2020-19890 MEDIUM 4.9 DOWNGRADE DBHcms v1.2.0 has an Arbitrary file read vulnerability in dbhcms\mod\mod.editor.php $_GET['file'] is filename,
- CVE-2020-19889 HIGH 8.8 DOWNGRADE DBHcms v1.2.0 has no CSRF protection mechanism,as demonstrated by CSRF for index.php?dbhcms_pid=-70 can add a
- CVE-2020-19888 MEDIUM 5.9 DOWNGRADE DBHcms v1.2.0 has an unauthorized operation vulnerability because there's no access control at line 175 of dbh
- CVE-2020-19887 MEDIUM 4.8 DOWNGRADE DBHcms v1.2.0 has a stored XSS vulnerability as there is no htmlspecialchars function for '$_POST['pageparam_i
- CVE-2020-19886 HIGH 8.1 DOWNGRADE DBHcms v1.2.0 has no CSRF protection mechanism,as demonstrated by CSRF for an /index.php?dbhcms_pid=-80&delete
- CVE-2020-19885 MEDIUM 4.8 DOWNGRADE DBHcms v1.2.0 has a stored xss vulnerability as there is no htmlspecialchars function for '$_POST['pageparam_i
- CVE-2020-19884 MEDIUM 4.8 DOWNGRADE DBHcms v1.2.0 has a stored xss vulnerability as there is no htmlspecialchars function in dbhcms\mod\mod.domain
- CVE-2020-19883 MEDIUM 4.8 DOWNGRADE DBHcms v1.2.0 has a stored xss vulnerability as there is no security filter in dbhcms\mod\mod.users.view.php l
- CVE-2020-19882 MEDIUM 4.8 DOWNGRADE DBHcms v1.2.0 has a stored xss vulnerability as there is no htmlspecialchars function for 'menu_description' v
- CVE-2020-19881 MEDIUM 4.8 DOWNGRADE DBHcms v1.2.0 has a reflected xss vulnerability as there is no security filter in dbhcms\mod\mod.selector.php
- CVE-2020-19880 MEDIUM 6.1 DOWNGRADE DBHcms v1.2.0 has a stored xss vulnerability as there is no htmlspecialchars function form 'Name' in dbhcms\ty
- CVE-2020-19879 MEDIUM 6.1 DOWNGRADE DBHcms v1.2.0 has a stored xss vulnerability as there is no security filter of $_GET['dbhcms_pid'] variable in
- CVE-2020-19878 HIGH 7.5 DOWNGRADE DBHcms v1.2.0 has a sensitive information leaks vulnerability as there is no security access control in /dbhcm
- CVE-2020-19877 MEDIUM 5.3 DOWNGRADE DBHcms v1.2.0 has a directory traversal vulnerability as there is no directory control function in directory /
FAQ
How do I fix dbhcms vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is dbhcms being exploited right now?
None of the tracked dbhcms CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which dbhcms CVE should I patch first?
CVE-2020-19878 currently ranks highest (55/100): DBHcms v1.2.0 has a sensitive information leaks vulnerability as there is no security access control in /dbhcm.