# zoujingli/thinkadmin (Packagist) vulnerabilities

6 known vulnerabilities, with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://packagist.org/packages/zoujingli/thinkadmin

## Advisories (6)

### [CVE-2023-48966](https://cve.now/CVE-2023-48966): An arbitrary file upload vulnerability in the component /admin/api.upload/file of ThinkAdmin v6.1.53 allows attackers to execute arbitrary…

- Severity: Unrated
- Published: Dec 4, 2023
- Affected: through 6.1.53.

### [CVE-2020-35296](https://cve.now/CVE-2020-35296): ThinkAdmin v6 has default administrator credentials, which allows attackers to gain unrestricted administratior dashboard access.

- Severity: Unrated
- Published: Mar 3, 2021
- Affected: versions 6.0.

### [CVE-2020-23653](https://cve.now/CVE-2020-23653): An insecure unserialize vulnerability was discovered in ThinkAdmin versions 4.x through 6.x in app/admin/controller/api/Update.php and…

- Severity: Unrated
- Published: Jan 13, 2021
- Affected: from 4.0, fixed in 6.1.0.

### [CVE-2020-29315](https://cve.now/CVE-2020-29315): ThinkAdmin version v1 v6 has a stored XSS vulnerability which allows remote attackers to inject an arbitrary web script or HTML.

- Severity: Unrated
- Published: Dec 1, 2020
- Affected: fixed in 6.0.22.

### [CVE-2020-25540](https://cve.now/CVE-2020-25540): ThinkAdmin v6 is affected by a directory traversal vulnerability.

- Severity: Unrated
- Published: Sep 14, 2020
- Affected: versions 6.0.

### [CVE-2019-11018](https://cve.now/CVE-2019-11018): application\\admin\\controller\\User.php in ThinkAdmin V4.0 does not prevent continued use of an administrator's cookie-based credentials…

- Severity: Unrated
- Published: Apr 8, 2019
- Affected: versions 4.0.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/packagist/zoujingli/thinkadmin
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.