| CVE-2024-26557 | 中5.4 | Codiad v2.8.4 allows reflected XSS via the components/market/dialog.php type parameter. | 22/03/2024 |
| CVE-2017-20178 | 高7.5 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Codiad 2.8.0. It has been rated as problematic. Affected by this issue is the function saveJSON of the file components/install/process.php. The manipulation of the argument data leads to information disclosure. The attack may be launched remotely. The complex | 21/02/2023 |
| CVE-2020-23355 | 高7.5 | ** PRODUCT NOT SUPPORTED WHEN ASSIGNED ** Codiad 2.8.4 /componetns/user/class.user.php:Authenticate() is vulnerable in magic hash authentication bypass. If encrypted or hash value for the passwords form certain formats of magic hash, e.g, 0e123, another hash value 0e234 something can successfully authenticate. | 27/01/2021 |
| CVE-2020-14042 | 中6.1 | ** PRODUCT NOT SUPPORTED WHEN ASSIGNED ** A Cross Site Scripting (XSS) vulnerability was found in Codiad v1.7.8 and later. The vulnerability occurs because of improper sanitization of the folder's name $path variable in components/filemanager/class.filemanager.php. NOTE: the vendor states "Codiad is no longer under act | 25/08/2020 |
| CVE-2020-14044 | 高7.2 | ** PRODUCT NOT SUPPORTED WHEN ASSIGNED ** A Server-Side Request Forgery (SSRF) vulnerability was found in Codiad v1.7.8 and later. A user with admin privileges could use the plugin install feature to make the server request any URL via components/market/class.market.php. This could potentially result in remote code exe | 24/08/2020 |
| CVE-2020-14043 | 高8.8 | ** PRODUCT NOT SUPPORTED WHEN ASSIGNED ** A Cross Side Request Forgery (CSRF) vulnerability was found in Codiad v1.7.8 and later. The request to download a plugin from the marketplace is only available to admin users and it isn't CSRF protected in components/market/controller.php. This might cause admins to make a vuln | 24/08/2020 |
| CVE-2019-19208 | 緊急9.8 | Codiad Web IDE through 2.8.4 allows PHP Code injection. | 16/03/2020 |
| CVE-2018-19423 | 高7.2 | Codiad 2.8.4 allows remote authenticated administrators to execute arbitrary code by uploading an executable file. | 21/11/2018 |
| CVE-2018-14009 | 緊急9.8 | Codiad through 2.8.4 allows Remote Code Execution, a different vulnerability than CVE-2017-11366 and CVE-2017-15689. | 12/07/2018 |
| CVE-2017-11366 | 緊急9.8 | components/filemanager/class.filemanager.php in Codiad before 2.8.4 is vulnerable to remote command execution because shell commands can be embedded in parameter values, as demonstrated by search_file_type. | 21/08/2017 |
| CVE-2014-9582 | 中4.3 | Cross-site scripting (XSS) vulnerability in components/filemanager/dialog.php in Codiad 2.4.3 allows remote attackers to inject arbitrary web script or HTML via the short_name parameter in a rename action. NOTE: this issue was originally incorrectly mapped to CVE-2014-1137; see CVE-2014-1137 for more information. | 08/01/2015 |
| CVE-2014-9581 | 中5.0 | Directory traversal vulnerability in components/filemanager/download.php in Codiad 2.4.3 allows remote attackers to read arbitrary files via a .. (dot dot) in the path parameter. NOTE: this issue was originally incorrectly mapped to CVE-2014-1137; see CVE-2014-1137 for more information. | 08/01/2015 |
| CVE-2013-7257 | 中4.3 | Cross-site scripting (XSS) vulnerability in Codiad 2.0.7 allows remote attackers to inject arbitrary web script or HTML via the Project Name field. | 03/01/2014 |