Dynpg is a modestly represented web application within the vulnerability landscape and occupies a position more prominent than most comparable single-product vendors, with its recurring exposure clustered around application-layer weaknesses including cross-site scripting, SQL injection, path traversal, code injection, and sensitive information disclosure. The vendor's disclosures frequently acquire public exploit code, reflecting the accessibility and immediate utility of web-application flaws for attackers and researchers alike. Current severity, exploitation activity, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Dynpg over time
Signals from CVEs in this vendor scope (11 CVEs).
11 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2010-4400HIGH SQL injection vulnerability in _rights.php in DynPG CMS 4.2.0 allows remote attackers to execute arbitrary SQL commands via the giveRights_UserId parameter. | Dec 6, 2010 | 7.5 | 32 | NO | YES |
CVE-2010-1299MEDIUM Multiple PHP remote file inclusion vulnerabilities in DynPG CMS 4.1.0, and possibly earlier, when magic_quotes_gpc is disabled and register_globals is enabled, allow remote attacke | Apr 7, 2010 | 5.1 | 29 | NO | YES |
CVE-2010-4401MEDIUM languages.inc.php in DynPG CMS 4.2.0 allows remote attackers to obtain sensitive information via a direct request, which reveals the installation path in an error message. | Dec 6, 2010 | 5.0 | 28 | NO | YES |
CVE-2010-4399MEDIUM Directory traversal vulnerability in languages.inc.php in DynPG CMS 4.1.1 and 4.2.0, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via a .. (do | Dec 6, 2010 | 4.3 | 27 | NO | YES |
CVE-2020-27406MEDIUM Cross Site Scripting (XSS) vulnerability in DynPG 4.9.1, allows authenticated attackers to execute arbitrary code via the groupname. | Nov 2, 2021 | 5.4 | 21 | NO | NO |
CVE-2021-27531MEDIUM A cross-site scripting (XSS) vulnerability in DynPG version 4.9.2 allows remote attackers to inject JavaScript via the "query" parameter. | Mar 23, 2021 | 4.8 | 19 | NO | NO |
CVE-2021-27529MEDIUM A cross-site scripting (XSS) vulnerability in DynPG version 4.9.2 allows remote attackers to inject JavaScript via the "limit" parameter. | Mar 23, 2021 | 4.8 | 19 | NO | NO |
CVE-2021-27530MEDIUM A cross-site scripting (XSS) vulnerability in DynPG version 4.9.2 allow remote attacker to inject javascript via URI in /index.php. | Mar 23, 2021 | 4.8 | 18 | NO | NO |
CVE-2021-27528MEDIUM A cross-site scripting (XSS) vulnerability in DynPG version 4.9.2 allows remote attackers to inject JavaScript via the "refID" parameter. | Mar 23, 2021 | 4.8 | 18 | NO | NO |
CVE-2021-27527MEDIUM A cross-site scripting (XSS) vulnerability in DynPG version 4.9.2 allows remote attackers to inject JavaScript via the "valueID" parameter. | Mar 23, 2021 | 4.8 | 18 | NO | NO |
Signals from CVEs in this vendor scope (11 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Dynpg.
Media articles that mention a CVE ID that affects a product developed by Dynpg — matched by CVE ID, not by vendor name.