VendorsB3logsymphonyany version
Vulnerabilities

B3log Symphony any version

Ranked by severity, then by exploit likelihood. Click a CVE ID for its full record.

4CVEs
CVE-2024-23049
An issue in symphony v.3.6.3 and before allows a remote attacker to execute arbitrary code via the log4j component.
Published 2024-02-05 · Modified
9.8EPSS 0.012
CVE-2019-17488
b3log Symphony (aka Sym) before 3.6.0 has XSS via the HTTP User-Agent header.
Published 2019-10-10 · Modified
6.1EPSS 0.008
CVE-2019-9142
An issue was discovered in b3log Symphony (aka Sym) before v3.4.7. XSS exists via the userIntro and userNickname fields to processor/SettingsProcessor.java.
Published 2019-02-25 · Modified
6.1EPSS 0.008
CVE-2018-16249
In Symphony before 3.3.0, there is XSS in the Title under Post. The ID "articleTitle" of this is stored in the "articleTitle" JSON field, and executes a payload when accessing the /member/test/points URI, allowing remote attacks. Any Web script or HTML can be inserted by an admin-authenticated user via a crafted web site name.
Published 2019-06-20 · Modified
4.8EPSS 0.005