WebsiteBaker v2.10.0 vulnerabilities
4 known CVE vulnerabilities in WebsiteBaker v2.10.0, translated and rated.
- CVE-2021-47788High
WebsiteBaker 2.13.0 contains an authenticated remote code execution vulnerability that allows users with language editing permissions to execute arbitrary code. Attackers can exploit the language installation endpoint by manipulating language installation parameters to achieve remote code execution on the server.
- CVE-2014-9242High
CVE-2014-9242 is an SQL injection vulnerability in admin/pages/modify.php in WebsiteBaker 2.8.3 that allows remote attackers to execute arbitrary SQL commands via the page_id parameter.
- CVE-2017-9771Critical
The install/save.php file in WebsiteBaker version 2.10.0 has a vulnerability that allows remote attackers to execute arbitrary PHP code via the database_username, database_host, or database_password parameters.
- CVE-2017-9360Critical
WebsiteBaker v2.10.0 has a SQL injection vulnerability in /account/details.php.