Bigace is a content-management system with a niche but concentrated footprint, where the vendor's disclosures cluster around web-application input-handling and access-control weaknesses including cross-site scripting, path traversal, code injection, and sensitive information exposure. Public exploit code has frequently been made available for this vendor's vulnerabilities, reflecting the appeal of web applications as targets and the relative accessibility of its attack surface; live severity and exploitation counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Bigace over time
Signals from CVEs in this vendor scope (7 CVEs).
7 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2006-4423HIGH Multiple PHP remote file inclusion vulnerabilities in Bigace 1.8.2 allow remote attackers to execute arbitrary PHP code via a URL in the (1) GLOBALS[_BIGACE][DIR][admin] parameter | Aug 29, 2006 | 7.5 | 29 | NO | YES |
CVE-2009-2379MEDIUM Directory traversal vulnerability in public/index.php in BIGACE Web CMS 2.6 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the cmd param | Jul 8, 2009 | 6.8 | 28 | NO | YES |
CVE-2008-2520HIGH Multiple PHP remote file inclusion vulnerabilities in BigACE 2.4, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the (1) GLOBAL | Jun 3, 2008 | 7.5 | 28 | NO | YES |
CVE-2009-1778MEDIUM SQL injection vulnerability in the new user registration feature in BigACE CMS 2.5, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via | May 22, 2009 | 6.8 | 26 | NO | YES |
CVE-2012-5173MEDIUM Session fixation vulnerability in BIGACE before 2.7.8 allows remote attackers to hijack web sessions via unspecified vectors. | Nov 23, 2012 | 6.8 | 22 | NO | NO |
CVE-2011-3711MEDIUM BIGACE 2.7.5 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated b | Sep 23, 2011 | 5.0 | 16 | NO | NO |
CVE-2009-3120MEDIUM Cross-site scripting (XSS) vulnerability in public/index.php in BIGACE Web CMS 2.6 allows remote attackers to inject arbitrary web script or HTML via the id parameter. NOTE: some | Sep 9, 2009 | 4.3 | 15 | NO | NO |
Signals from CVEs in this vendor scope (7 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Bigace.
Media articles that mention a CVE ID that affects a product developed by Bigace — matched by CVE ID, not by vendor name.