Skip to main content
cve.nowby Sazabi
← Packagist
PackagistPackage

zoujingli/thinkadmin

6 known vulnerabilities, with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
6
Registry
Packagist

Advisories 6

  • An arbitrary file upload vulnerability in the component /admin/api.upload/file of ThinkAdmin v6.1.53 allows attackers to execute arbitrary…

    Affected: through 6.1.53.

  • ThinkAdmin v6 has default administrator credentials, which allows attackers to gain unrestricted administratior dashboard access.

    Affected: versions 6.0.

  • An insecure unserialize vulnerability was discovered in ThinkAdmin versions 4.x through 6.x in app/admin/controller/api/Update.php and…

    Affected: from 4.0, fixed in 6.1.0.

  • ThinkAdmin version v1 v6 has a stored XSS vulnerability which allows remote attackers to inject an arbitrary web script or HTML.

    Affected: fixed in 6.0.22.

  • ThinkAdmin v6 is affected by a directory traversal vulnerability.

    Affected: versions 6.0.

  • application\admin\controller\User.php in ThinkAdmin V4.0 does not prevent continued use of an administrator's cookie-based credentials…

    Affected: versions 4.0.