Jetbox maintains a focused but prominent content management system product line, with vulnerabilities concentrated in its flagship Jetbox CMS and Jetbox One CMS offerings that serve web publishing and editorial workflows. The exposure centers on application-layer weaknesses typical of web-facing software, including improper authentication, cross-site scripting, and SQL injection—input-handling and access-control issues that recur across the CMS portfolio. Public exploit code and tooling have frequently become available for this vendor's disclosures, elevating the practical risk to operators who defer patching. Defenders should treat Jetbox CMS updates as moderately urgent, particularly when instances are internet-reachable or handle sensitive content; current exploitation activity and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Jetbox over time
Signals from CVEs in this vendor scope (21 CVEs).
21 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2006-2270HIGH PHP remote file inclusion vulnerability in includes/config.php in Jetbox CMS 2.1 allows remote attackers to execute arbitrary code via a URL in the relative_script_path parameter. | May 9, 2006 | 7.5 | 35 | NO | YES |
CVE-2007-2732MEDIUM Multiple cross-site scripting (XSS) vulnerabilities in Jetbox CMS allow remote attackers to inject arbitrary web script or HTML via the (1) path parameter to view/search/; or the ( | May 16, 2007 | 6.8 | 30 | NO | YES |
CVE-2006-4422HIGH PHP remote file inclusion vulnerability in includes/phpdig/libs/search_function.php in Jetbox CMS 2.1 allows remote attackers to execute arbitrary PHP code via a URL in the relativ | Aug 29, 2006 | 7.5 | 29 | NO | YES |
CVE-2007-2685HIGH Multiple SQL injection vulnerabilities in index.php in Jetbox CMS 2.1 allow remote attackers to execute arbitrary SQL commands via the (1) view or (2) login parameter. | May 21, 2007 | 7.5 | 28 | NO | YES |
CVE-2008-6174MEDIUM Cross-site scripting (XSS) vulnerability in admin/postlister/index.php in Jetbox CMS 2.1 allows remote attackers to inject arbitrary web script or HTML via the liste parameter. | Feb 19, 2009 | 4.3 | 24 | NO | YES |
CVE-2008-4651MEDIUM Multiple SQL injection vulnerabilities in Jetbox CMS 2.1 allow remote authenticated users to execute arbitrary SQL commands via the (1) orderby parameter to admin/cms/images.php an | Oct 22, 2008 | 6.0 | 24 | NO | YES |
CVE-2007-1898MEDIUM formmail.php in Jetbox CMS 2.1 allows remote attackers to send arbitrary e-mails (spam) via modified recipient, _SETTINGS[allowed_email_hosts][], and subject parameters. | May 16, 2007 | 5.8 | 24 | NO | YES |
CVE-2007-2686MEDIUM Cross-site scripting (XSS) vulnerability in index.php in Jetbox CMS 2.1 allows remote attackers to inject arbitrary web script or HTML via the login parameter in a sendpwd task. | May 22, 2007 | 4.3 | 21 | NO | YES |
CVE-2006-4737HIGH SQL injection vulnerability in index.php in Jetbox CMS allows remote attackers to inject arbitrary web script or HTML via the item parameter. NOTE: The view vector is already cove | Sep 13, 2006 | 7.5 | 19 | NO | NO |
CVE-2006-4738HIGH PHP remote file inclusion vulnerability in phpthumb.php in Jetbox CMS allows remote attackers to execute arbitrary PHP code via a URL in the includes_path parameter. NOTE: The rel | Sep 13, 2006 | 7.5 | 19 | NO | NO |
Signals from CVEs in this vendor scope (21 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Jetbox.
Media articles that mention a CVE ID that affects a product developed by Jetbox — matched by CVE ID, not by vendor name.