tribalsystems 関連製品全体の CVE とセキュリティ脆弱性情報を集約し、CVSS、EPSS、公開日、脆弱性情報データを掲載しています。
公開された問題は vendor risk sql injection、vendor risk csrf, and vendor risk input validation に関連することが多く、vendor surface production workloads and vendor surface software deployment の文脈で vendor impact data exposure and vendor impact unexpected behavior などの暴露リスクを伴う場合があります。
掲載データは公開脆弱性情報とセキュリティ公告に基づき、過去の暴露面と修補優先度の評価に利用できます。
| CVE | 概要 | ソース | CVSS 最大値 | EPSS（%） | 公開 | 更新 |
|---|---|---|---|---|---|---|
| CVE-2024-45964 | Zenario 9.7.61188 is vulnerable to Cross Site Scripting (XSS) in the Image library via the "Organizer tags" field. | [email protected] | 4.8 | 0.34% | 2024-10-02 | 2026-06-17 |
| CVE-2024-45960 | Zenario 9.7.61188 allows authenticated admin users to upload PDF files containing malicious code into the target system. If the PDF file is accessed through the website, it can trigger a Cross Site Scripting (XSS) attack. | [email protected] | 4.8 | 0.33% | 2024-10-02 | 2026-06-17 |
| CVE-2023-44769 | A Cross-Site Scripting (XSS) vulnerability in Zenario CMS v.9.4.59197 allows a local attacker to execute arbitrary code via a crafted script to the Spare aliases from Alias. | [email protected] | 5.4 | 0.66% | 2023-10-25 | 2026-06-17 |
| CVE-2023-44771 | A Cross-Site Scripting (XSS) vulnerability in Zenario CMS v.9.4.59197 allows a local attacker to execute arbitrary code via a crafted script to the Page Layout. | [email protected] | 5.4 | 0.54% | 2023-10-06 | 2026-06-17 |
| CVE-2023-44770 | A Cross-Site Scripting (XSS) vulnerability in Zenario CMS v.9.4.59197 allows an attacker to execute arbitrary code via a crafted script to the Organizer - Spare alias. | [email protected] | 5.4 | 0.55% | 2023-10-06 | 2026-06-17 |
| CVE-2023-39578 | A stored cross-site scripting (XSS) vulnerability in the Create function of Zenario CMS v9.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Menu navigation text field. | [email protected] | 4.8 | 0.38% | 2023-08-28 | 2026-06-17 |
| CVE-2022-44136 | Zenario CMS 9.3.57186 is vulnerable to Remote Code Excution (RCE). | [email protected] | 9.8 | 1.11% | 2022-11-30 | 2026-06-17 |
| CVE-2022-4231 | A vulnerability, which was classified as problematic, has been found in Tribal Systems Zenario CMS 9.3.57595. This issue affects some unknown processing of the component Remember Me Handler. The manipulation leads to session fixiation. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-214589 was assigned to this vulnerability. | [email protected] | 4.2 | 0.44% | 2022-11-30 | 2026-06-17 |
| CVE-2022-44073 | Zenario CMS 9.3.57186 is vulnerable to Cross Site Scripting (XSS) via svg,Users & Contacts. | [email protected] | 5.4 | 0.45% | 2022-11-16 | 2026-06-17 |
| CVE-2022-44071 | Zenario CMS 9.3.57186 is is vulnerable to Cross Site Scripting (XSS) via profile. | [email protected] | 5.4 | 0.45% | 2022-11-16 | 2026-06-17 |
| CVE-2022-44070 | Zenario CMS 9.3.57186 is vulnerable to Cross Site Scripting (XSS) via News articles. | [email protected] | 5.4 | 0.45% | 2022-11-16 | 2026-06-17 |
| CVE-2022-44069 | Zenario CMS 9.3.57186 is vulnerable to Cross Site Scripting (XSS) via the Nest library module. | [email protected] | 5.4 | 0.45% | 2022-11-16 | 2026-06-17 |
| CVE-2020-36608 | A vulnerability, which was classified as problematic, has been found in Tribal Systems Zenario CMS. Affected by this issue is some unknown functionality of the file admin_organizer.js of the component Error Log Module. The manipulation leads to cross site scripting. The attack may be launched remotely. The name of the patch is dfd0afacb26c3682a847bea7b49ea440b63f3baa. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-212816. | [email protected] | 3.5 | 0.40% | 2022-11-02 | 2026-06-16 |
| CVE-2021-42171 | Zenario CMS 9.0.54156 is vulnerable to File Upload. The web server can be compromised by uploading and executing a web-shell which can run commands, browse system files, browse local resources, attack other servers, and exploit the local vulnerabilities, and so forth. | [email protected] | 7.2 | 2.48% | 2022-03-14 | 2026-06-17 |
| CVE-2021-41952 | Zenario CMS 9.0.54156 is vulnerable to Cross Site Scripting (XSS) via upload file to *.SVG. An attacker can send malicious files to victims and steals victim's cookie leads to account takeover. The person viewing the image of a contact can be victim of XSS. | [email protected] | 4.8 | 0.51% | 2022-03-14 | 2026-06-17 |
| CVE-2022-23043 | Zenario CMS 9.2 allows an authenticated admin user to bypass the file upload restriction by creating a new 'File/MIME Types' using the '.phar' extension. Then an attacker can upload a malicious file, intercept the request and change the extension to '.phar' in order to run commands on the server. | [email protected] | 7.2 | 1.44% | 2022-02-24 | 2026-06-17 |
| CVE-2021-26830 | SQL Injection in Tribalsystems Zenario CMS 8.8.52729 allows remote attackers to access the database or delete the plugin. This is accomplished via the `ID` input field of ajax.php in the `Pugin library - delete` module. | [email protected] | 9.1 | 4.57% | 2021-04-16 | 2026-06-16 |
| CVE-2021-27673 | Cross Site Scripting (XSS) in the "admin_boxes.ajax.php" component of Tribal Systems Zenario CMS v8.8.52729 allows remote attackers to execute arbitrary code by injecting arbitrary HTML into the "cID" parameter when creating a new HTML component. | [email protected] | 4.8 | 1.09% | 2021-04-15 | 2026-06-16 |
| CVE-2021-27672 | SQL Injection in the "admin_boxes.ajax.php" component of Tribal Systems Zenario CMS v8.8.52729 allows remote attackers to obtain sesnitive database information by injecting SQL commands into the "cID" parameter when creating a new HTML component. | [email protected] | 4.9 | 1.33% | 2021-04-15 | 2026-06-16 |
| CVE-2018-18420 | Cross-Site Request Forgery (CSRF) vulnerability was discovered in the 8.3 version of Zenario Content Management System via the admin/organizer.ajax.php?path=zenario__content%2Fpanels%2Fcontent URI. | [email protected] | 8.8 | 0.82% | 2018-10-19 | 2026-06-16 |