Dbhcms Project maintains a content-management system with a modest vulnerability footprint centered on web-application logic and access control. The recurring weakness classes—cross-site scripting, cross-site request forgery, authorization bypass, improper authentication, and path traversal—reflect common structural gaps in web-tier input handling, session validation, and privilege enforcement that defenders should address through systematic input sanitization and access-control review. Current severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Dbhcms Project over time
Signals from CVEs in this vendor scope (15 CVEs).
15 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2020-19889HIGH DBHcms v1.2.0 has no CSRF protection mechanism,as demonstrated by CSRF for index.php?dbhcms_pid=-70 can add a user. | Aug 24, 2020 | 8.8 | 26 | NO | NO |
CVE-2020-19886HIGH DBHcms v1.2.0 has no CSRF protection mechanism,as demonstrated by CSRF for an /index.php?dbhcms_pid=-80&deletemenu=9 can delete any menu. | Aug 24, 2020 | 8.1 | 25 | NO | NO |
CVE-2020-19891HIGH DBHcms v1.2.0 has an Arbitrary file write vulnerability in dbhcms\mod\mod.editor.php $_POST['updatefile'] is filename and $_POST['tinymce_content'] is file content, there is no fil | Aug 24, 2020 | 7.2 | 23 | NO | NO |
CVE-2020-19879MEDIUM DBHcms v1.2.0 has a stored xss vulnerability as there is no security filter of $_GET['dbhcms_pid'] variable in dbhcms\page.php line 107, | Aug 24, 2020 | 6.1 | 21 | NO | NO |
CVE-2020-19890MEDIUM DBHcms v1.2.0 has an Arbitrary file read vulnerability in dbhcms\mod\mod.editor.php $_GET['file'] is filename,and as there is no filter function for security, you can read any file | Aug 24, 2020 | 4.9 | 20 | NO | NO |
CVE-2020-19888MEDIUM DBHcms v1.2.0 has an unauthorized operation vulnerability because there's no access control at line 175 of dbhcms\page.php for empty cache operation. This vulnerability can be expl | Aug 24, 2020 | 5.9 | 20 | NO | NO |
CVE-2020-19880MEDIUM DBHcms v1.2.0 has a stored xss vulnerability as there is no htmlspecialchars function form 'Name' in dbhcms\types.php, A remote unauthenticated attacker can exploit this vulnerabil | Aug 24, 2020 | 6.1 | 20 | NO | NO |
CVE-2020-19877MEDIUM DBHcms v1.2.0 has a directory traversal vulnerability as there is no directory control function in directory /dbhcms/. A remote unauthenticated attacker can exploit this vulnerabil | Aug 24, 2020 | 5.3 | 20 | NO | NO |
CVE-2020-19885MEDIUM DBHcms v1.2.0 has a stored xss vulnerability as there is no htmlspecialchars function for '$_POST['pageparam_insert_name']' variable in dbhcms\mod\mod.page.edit.php line 227, A rem | Aug 24, 2020 | 4.8 | 19 | NO | NO |
CVE-2020-19878HIGH DBHcms v1.2.0 has a sensitive information leaks vulnerability as there is no security access control in /dbhcms/ext/news/ext.news.be.php, A remote unauthenticated attacker can expl | Aug 24, 2020 | 7.5 | 19 | NO | NO |
Signals from CVEs in this vendor scope (15 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Dbhcms Project.
Media articles that mention a CVE ID that affects a product developed by Dbhcms Project — matched by CVE ID, not by vendor name.