# tribalsystems/zenario (Packagist) vulnerabilities 22 known vulnerabilities (2 critical, 8 medium, 1 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: not known (cve.now hasn't read this package's releases) - Newest unaffected release: not known without release data - Registry: https://packagist.org/packages/tribalsystems/zenario ## Advisories (22) ### [CVE-2024-45964](https://cve.now/CVE-2024-45964): Zenario 9.7.61188 is vulnerable to Cross Site Scripting (XSS) in the Image library via the "Organizer tags" field. - Severity: Medium 4.8 - Published: Oct 2, 2024 - Affected: through 9.7.61188. ### [CVE-2024-45960](https://cve.now/CVE-2024-45960): Zenario 9.7.61188 allows authenticated admin users to upload PDF files containing malicious code into the target system. - Severity: Medium 4.8 - Published: Oct 2, 2024 - Affected: through 9.7.61188. ### [CVE-2024-34461](https://cve.now/CVE-2024-34461): Zenario before 9.5.60437 uses Twig filters insecurely in the Twig Snippet plugin, and in the site-wide HEAD and BODY elements, enabling… - Severity: Critical 9.8 - Published: May 4, 2024 - Affected: fixed in 9.5.60437. ### [CVE-2024-34460](https://cve.now/CVE-2024-34460): The Tree Explorer tool from Organizer in Zenario before 9.5.60602 is affected by XSS. - Severity: Medium 6.5 - Published: May 4, 2024 - Affected: fixed in 9.5.60602. ### [CVE-2023-44769](https://cve.now/CVE-2023-44769): A Cross-Site Scripting (XSS) vulnerability in Zenario CMS v.9.4.59197 allows a local attacker to execute arbitrary code via a crafted… - Severity: Unrated - Published: Oct 24, 2023 - Affected: through 9.4.59197. ### [CVE-2023-44771](https://cve.now/CVE-2023-44771): A Cross-Site Scripting (XSS) vulnerability in Zenario CMS v.9.4.59197 allows a local attacker to execute arbitrary code via a crafted… - Severity: Unrated - Published: Oct 6, 2023 - Affected: through 9.4.59197. ### [CVE-2023-44770](https://cve.now/CVE-2023-44770): A Cross-Site Scripting (XSS) vulnerability in Zenario CMS v.9.4.59197 allows an attacker to execute arbitrary code via a crafted script to… - Severity: Unrated - Published: Oct 6, 2023 - Affected: through 9.4.59197. ### [CVE-2022-44136](https://cve.now/CVE-2022-44136): Zenario CMS 9.3.57186 is vulnerable to Remote Code Excution (RCE). - Severity: Critical 9.8 - Published: Nov 30, 2022 - Affected: fixed in 9.0.57473. ### [CVE-2022-4231](https://cve.now/CVE-2022-4231): Tribal Systems Zenario CMS Remember Me session fixiation - Severity: Medium 4.2 - Published: Nov 30, 2022 - Affected: through 9.3.57595. ### [CVE-2022-44073](https://cve.now/CVE-2022-44073): Zenario CMS 9.3.57186 is vulnerable to Cross Site Scripting (XSS) via svg,Users & Contacts. - Severity: Medium 5.4 - Published: Nov 16, 2022 - Affected: through 9.3.57186. ### [CVE-2022-44071](https://cve.now/CVE-2022-44071): Zenario CMS 9.3.57186 is is vulnerable to Cross Site Scripting (XSS) via profile. - Severity: Medium 5.4 - Published: Nov 16, 2022 - Affected: through 9.3.57186. ### [CVE-2022-44070](https://cve.now/CVE-2022-44070): Zenario CMS 9.3.57186 is vulnerable to Cross Site Scripting (XSS) via News articles. - Severity: Medium 5.4 - Published: Nov 16, 2022 - Affected: through 9.3.57186. ### [CVE-2022-44069](https://cve.now/CVE-2022-44069): Zenario CMS 9.3.57186 is vulnerable to Cross Site Scripting (XSS) via the Nest library module. - Severity: Medium 5.4 - Published: Nov 16, 2022 - Affected: through 9.3.57186. ### [CVE-2020-36608](https://cve.now/CVE-2020-36608): Tribal Systems Zenario CMS Error Log Module admin\_organizer.js cross site scripting - Severity: Low 3.5 - Published: Nov 2, 2022 - Affected: fixed in 8.5.51340. ### [CVE-2021-41952](https://cve.now/CVE-2021-41952): Zenario CMS 9.0.54156 is vulnerable to Cross Site Scripting (XSS) via upload file to \*.SVG. - Severity: Unrated - Published: Mar 14, 2022 - Affected: fixed in 9.0.55143. ### [CVE-2021-42171](https://cve.now/CVE-2021-42171): Zenario CMS 9.0.54156 is vulnerable to File Upload. - Severity: Unrated - Published: Mar 14, 2022 - Affected: fixed in 9.0.55143. ### [CVE-2022-23043](https://cve.now/CVE-2022-23043): Zenario CMS 9.2 allows an authenticated admin user to bypass the file upload restriction by creating a new 'File/MIME Types' using the… - Severity: Unrated - Published: Feb 22, 2022 - Affected: fixed in 9.2.55826. ### [CVE-2021-26830](https://cve.now/CVE-2021-26830): SQL Injection in Tribalsystems Zenario CMS 8.8.52729 allows remote attackers to access the database or delete the plugin. - Severity: Unrated - Published: Apr 16, 2021 - Affected: fixed in 8.8.53370. ### [CVE-2021-27673](https://cve.now/CVE-2021-27673): Cross Site Scripting (XSS) in the "admin\_boxes.ajax.php" component of Tribal Systems Zenario CMS v8.8.52729 allows remote attackers to… - Severity: Unrated - Published: Apr 15, 2021 - Affected: fixed in 8.8.53370. ### [CVE-2021-27672](https://cve.now/CVE-2021-27672): SQL Injection in the "admin\_boxes.ajax.php" component of Tribal Systems Zenario CMS v8.8.52729 allows remote attackers to obtain sesnitive… - Severity: Unrated - Published: Apr 15, 2021 - Affected: fixed in 8.8.53370. ### [CVE-2018-18420](https://cve.now/CVE-2018-18420): Cross-Site Request Forgery (CSRF) vulnerability was discovered in the 8.3 version of Zenario Content Management System via the… - Severity: Unrated - Published: Oct 19, 2018 - Affected: all versions. ### [CVE-2018-5960](https://cve.now/CVE-2018-5960): Zenario v7.1 - v7.6 has SQL injection via the \`Name\` input field of organizer.php or admin\_boxes.ajax.php in the \`Categories - Edit\` module. - Severity: Unrated - Published: Jan 22, 2018 - Affected: from 7.1, through 7.6. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/packagist/tribalsystems/zenario Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.