https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-19T04:30:38.952564+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2017-9443 CVE-2017-9443 2026-10-19T04:30:38.953644+00:00

Affected: bigtreecms bigtree_cms

BigTree CMS through 4.2.18 allows remote authenticated users to conduct SQL injection attacks via a crafted tables object in manifest.json in an uploaded package. This issue exists in core\admin\modules\developer\extensions\install\process.php and core\admin\modules\developer\packages\install\process.php. NOTE: the vendor states "You must implicitly trust any package or extension you install as they all have the ability to write PHP files.