Indexhibit is a lightweight web-based portfolio and gallery platform whose vulnerability profile concentrates in its core application and centers on common web application input-handling and access-control flaws. The recurring weakness classes—cross-site request forgery, cross-site scripting, improper input validation, path traversal, and permission assignment issues—reflect the typical attack surface of an unvalidated or insufficiently hardened web application. Vulnerabilities affecting this vendor skew toward serious outcomes; live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Indexhibit over time
Signals from CVEs in this vendor scope (8 CVEs).
8 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2019-16314CRITICAL Indexhibit 2.1.5 allows a product reinstallation, with resultant remote code execution, via /ndxzstudio/install.php?p=2. | Sep 14, 2019 | 9.8 | 51 | NO | NO |
CVE-2020-18121HIGH A configuration issue in Indexhibit 2.1.5 allows authenticated attackers to modify .php files, leading to getshell. | Aug 30, 2021 | 8.8 | 27 | NO | NO |
CVE-2020-18127MEDIUM An issue in the /config/config.php component of Indexhibit 2.1.5 allows attackers to arbitrarily view files. | Aug 30, 2021 | 6.5 | 22 | NO | NO |
CVE-2019-8954HIGH In Indexhibit 2.1.5, remote attackers can execute arbitrary code via the v parameter (in conjunction with the id parameter) in a upd_jxcode=true action to the ndxzstudio/?a=system | Feb 20, 2019 | 8.8 | 22 | NO | NO |
CVE-2020-18125MEDIUM A reflected cross-site scripting (XSS) vulnerability in the /plugin/ajax.php component of Indexhibit 2.1.5 allows attackers to execute arbitrary web scripts or HTML. | Aug 30, 2021 | 6.1 | 21 | NO | NO |
CVE-2020-18123MEDIUM A cross-site request forgery (CSRF) vulnerability in Indexhibit 2.1.5 allows attackers to arbitrarily delete admin accounts. | Aug 30, 2021 | 6.5 | 21 | NO | NO |
CVE-2020-18124MEDIUM A cross-site request forgery (CSRF) vulnerability in Indexhibit 2.1.5 allows attackers to arbitrarily reset account passwords. | Aug 30, 2021 | 5.7 | 16 | NO | NO |
CVE-2020-18126MEDIUM Multiple stored cross-site scripting (XSS) vulnerabilities in the Sections module of Indexhibit 2.1.5 allows attackers to execute arbitrary web scripts or HTML. | Aug 30, 2021 | 5.4 | 15 | NO | NO |
Signals from CVEs in this vendor scope (8 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Indexhibit.
Media articles that mention a CVE ID that affects a product developed by Indexhibit — matched by CVE ID, not by vendor name.