Toendacms

Vendor:

First CVE: Nov 16, 2005 · Active for 20 years

Total CVEs

More Total CVEs than 89% of tracked products

3.3

Avg CVEs / Year

Higher CVE frequency than 84% of tracked products

5.6

Avg CVSS

Higher Avg CVSS than 19% of tracked products

0.0%

KEV Rate

Bottom 1%

Trends Over Time

The number and severity of CVEs published that impact Toendacms over time

Volume of CVEsAvg CVSS Base Score

First CVE

Nov 16, 2005

20 years ago

Most Recent CVE

Apr 13, 2007

7,046 days ago

CVE Severity & Scoring

Toendacms10 CVEs

80%

20%

All CVEs353,240 CVEs

45%

40%

11%

MediumHigh

Attack Vector

Local0 (0.0%)

Network0 (0.0%)

Unknown10 (100.0%)

Physical0 (0.0%)

Adjacent Network0 (0.0%)

Attack Complexity

Low0 (0.0%)

High0 (0.0%)

Unknown10 (100.0%)

User Interaction

None0 (0.0%)

Unknown10 (100.0%)

Required0 (0.0%)

Privileges Required

Low0 (0.0%)

High0 (0.0%)

None0 (0.0%)

Unknown10 (100.0%)

Top CVEs

Signals from CVEs in this product scope (10 CVEs).

10 CVEs · Highest risk first

CVE	Published	CVSS	Risk	KEV	Exploit
CVE-2006-4349HIGH PHP remote file inclusion vulnerability in ToendaCMS 1.0.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the tcms_administer_site parameter to an u	Aug 24, 2006	7.5	29	NO	YES
CVE-2006-3362MEDIUM Unrestricted file upload vulnerability in connectors/php/connector.php in FCKeditor mcpuk file manager, as used in (1) Geeklog 1.4.0 through 1.4.0sr3, (2) toendaCMS 1.0.0 Shizouka	Jul 6, 2006	5.1	24	NO	YES
CVE-2005-3550MEDIUM Directory traversal vulnerability in admin.php in toendaCMS before 0.6.2 allows remote attackers to access arbitrary files via a .. (dot dot) in the id_user parameter.	Nov 16, 2005	5.0	24	NO	YES
CVE-2007-1872MEDIUM Cross-site scripting (XSS) vulnerability in toendaCMS 1.5.3 allows remote attackers to inject arbitrary web script or HTML via the searchword parameter in a search id.	Apr 13, 2007	4.3	21	NO	YES
CVE-2005-4353HIGH SQL injection vulnerability in index.php in toendaCMS 0.6.2.1, when configured to use a SQL database, allows remote attackers to execute arbitrary SQL commands via the id parameter	Dec 20, 2005	7.5	19	NO	NO
CVE-2006-2799MEDIUM Cross-site scripting (XSS) vulnerability in content_footer.php in toendaCMS 0.7.0 allows remote attackers to inject arbitrary web scripts or HTML via the print_url variable. NOTE:	Jun 3, 2006	6.8	18	NO	NO
CVE-2005-4422MEDIUM Unrestricted file upload vulnerability in toendaCMS before 0.6.2 Stable allows remote authenticated administrators to execute arbitrary code by uploading a file with an executable	Dec 20, 2005	6.5	18	NO	NO
CVE-2005-3551MEDIUM toendaCMS before 0.6.2 stores user account and session data in the web root directory, which allows remote attackers to obtain sensitive information via a direct request to the app	Nov 16, 2005	5.0	15	NO	NO
CVE-2006-4016MEDIUM Cross-site scripting (XSS) vulnerability in /toendaCMS in toendaCMS stable 1.0.3 and earlier, and unstable 1.1 and earlier, allows remote attackers to inject arbitrary web script o	Aug 7, 2006	4.3	14	NO	NO
CVE-2005-4277MEDIUM Cross-site scripting (XSS) vulnerability in index.php in toendaCMS before 0.7 Beta allows remote attackers to inject arbitrary web script or HTML via the id parameter.	Dec 16, 2005	4.3	14	NO	NO

View all 10 CVEs →

Exploit Exposure

Signals from CVEs in this product scope (10 CVEs).

CISA KEV

0 CVEs

0.0% of CVEs· Bottom 1%

Metasploit

0 CVEs

0.0% of CVEs· Bottom 1%

Nuclei

0 CVEs

0.0% of CVEs· Bottom 1%

ExploitDB

4 CVEs

40.0% of CVEs· 89th percentile

Social Chatter

Signals from CVEs in this product scope (10 CVEs).

Media Mentions

Signals from CVEs in this product scope (10 CVEs).

Top CNAs Publishing CVEs For Toendacms

Versions

Version	CVE Count	Avg CVSS	Avg EPSS	Exploits
stable_1.0.3	1	7.5	2.8%	1
1.5.3	1	4.3	2.0%	1
1.0	2	6.3	3.9%	2
0.7	1	5.1	5.0%	1
0.6_pre-beta	2	5.5	1.4%	0
0.6_beta_3	2	5.5	1.4%	0
0.6_beta_2	2	5.5	1.4%	0
0.6_beta_1	2	5.5	1.4%	0
0.6.2.1	2	7.2	1.3%	0
0.6.2	1	5.1	5.0%	1
0.6.1	3	6.1	2.8%	1
0.6	1	6.8	1.3%	0