PatchTheCVElvyecms vulnerabilities and fixes
Recent CVEs affecting lvyecms, with upgrade or downgrade steps. 2 tracked.
lvyecms has 2 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 2. Most recent: 2017-11-20. Highest priority: CVE-2017-16903 (score 65/100).
- CVE-2017-16904 MEDIUM 6.1 UPGRADE The Public tologin feature in admin.php in LvyeCMS through 3.1 allows XSS via a crafted username that is misha
- CVE-2017-16903 CRITICAL 9.8 UPGRADE LvyeCMS through 3.1 allows remote attackers to upload and execute arbitrary PHP code via directory traversal s
FAQ
How do I fix lvyecms vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is lvyecms being exploited right now?
None of the tracked lvyecms CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which lvyecms CVE should I patch first?
CVE-2017-16903 currently ranks highest (65/100): LvyeCMS through 3.1 allows remote attackers to upload and execute arbitrary PHP code via directory traversal s.