PatchTheCVEthinkcmf vulnerabilities
Recent CVEs affecting thinkcmf products. 3 tracked.
thinkcmf has 3 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 0. Most recent: 2023-08-11. Highest priority: CVE-2022-40489 (score 43/100).
- CVE-2022-40849 MEDIUM 5.4 DOWNGRADE ThinkCMF version 6.0.7 is affected by Stored Cross-Site Scripting (XSS)
- CVE-2022-40489 HIGH 8.8 DOWNGRADE ThinkCMF version 6.0.7 is affected by a Cross Site Request Forgery (CSRF) vulnerability that allows a Super Ad
- CVE-2020-25915 MEDIUM 5.4 DOWNGRADE Cross Site Scripting (XSS) vulnerability in UserController.php in ThinkCMF version 5.1.5, allows attackers to
FAQ
How do I fix thinkcmf vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is thinkcmf being exploited right now?
None of the tracked thinkcmf CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which thinkcmf CVE should I patch first?
CVE-2022-40489 currently ranks highest (43/100): ThinkCMF version 6.0.7 is affected by a Cross Site Request Forgery (CSRF) vulnerability that allows a Super Ad.