PatchTheCVErazorcms vulnerabilities
Recent CVEs affecting razorcms products. 5 tracked.
razorcms has 5 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 0. Most recent: 2018-12-31. Highest priority: CVE-2018-17986 (score 48/100).
- CVE-2018-19906 MEDIUM 5.4 DOWNGRADE Stored XSS exists in razorCMS 3.4.8 via the /#/page description parameter.
- CVE-2018-19905 MEDIUM 5.4 DOWNGRADE HTML injection exists in razorCMS 3.4.8 via the /#/page keywords parameter.
- CVE-2018-17986 HIGH 8.8 DOWNGRADE rars/user/data in razorCMS 3.4.8 allows CSRF for changing the password of an admin user.
- CVE-2018-16727 MEDIUM 5.4 DOWNGRADE razorCMS 3.4.7 allows Stored XSS via the keywords of the homepage within the settings component.
- CVE-2018-16726 MEDIUM 5.4 DOWNGRADE razorCMS 3.4.7 allows HTML injection via the description of the homepage within the settings component.
FAQ
How do I fix razorcms vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is razorcms being exploited right now?
None of the tracked razorcms CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which razorcms CVE should I patch first?
CVE-2018-17986 currently ranks highest (48/100): rars/user/data in razorCMS 3.4.8 allows CSRF for changing the password of an admin user..