CVE 検索
公開されているすべての CVE とオープンソースのセキュリティアドバイザリ（NVD、OSV、GitHub）を、CVSS、EPSS、実際に悪用されているか（CISA KEV）とともに掲載しています。数時間ごとに更新されます。スキャンでは、検出した技術とこれらを照合します。
公開されているすべての CVE とオープンソースのセキュリティアドバイザリ（NVD、OSV、GitHub）を、CVSS、EPSS、実際に悪用されているか（CISA KEV）とともに掲載しています。数時間ごとに更新されます。スキャンでは、検出した技術とこれらを照合します。
| 17/12/2025 |
| CVE-2023-50038 | 高8.8 | There is an arbitrary file upload vulnerability in the background of textpattern cms v4.8.8, which leads to the loss of server permissions. | 28/12/2023 |
| CVE-2023-36220 | 高7.2 | Directory Traversal vulnerability in Textpattern CMS v4.8.8 allows a remote authenticated attacker to execute arbitrary code and gain access to sensitive information via the plugin Upload function. | 07/08/2023 |
| CVE-2023-24269 | 高8.8 | An arbitrary file upload vulnerability in the plugin upload function of Textpattern v4.8.8 allows attackers to execute arbitrary code via a crafted Zip file. | 28/04/2023 |
| CVE-2023-26852 | 高7.2 | An arbitrary file upload vulnerability in the upload plugin of Textpattern v4.8.8 and below allows attackers to execute arbitrary code by uploading a crafted PHP file. | 12/04/2023 |
| CVE-2021-40642 | 中4.3 | Textpattern CMS v4.8.7 and older vulnerability exists through Sensitive Cookie in HTTPS Session Without 'Secure' Attribute via textpattern/lib/txplib_misc.php. The secure flag is not set for txp_login session cookie in the application. If the secure flag is not set, then the cookie will be transmitted in clear-text if | 29/06/2022 |
| CVE-2021-40658 | 中4.8 | Textpattern 4.8.7 is affected by a HTML injection vulnerability through “Content>Write>Body”. | 14/06/2022 |
| CVE-2021-44082 | 高8.3 | textpattern 4.8.7 is vulnerable to Cross Site Scripting (XSS) via /textpattern/index.php,Body. A remote and unauthenticated attacker can use XSS to trigger remote code execution by uploading a webshell. To do so they must first steal the CSRF token before submitting a file upload request. | 29/03/2022 |
| CVE-2021-28002 | 中5.4 | A persistent cross-site scripting vulnerability was discovered in the Excerpt parameter in Textpattern CMS 4.9.0 which allows remote attackers to execute arbitrary code via a crafted payload entered into the URL field. The vulnerability is triggered by users visiting the 'Articles' page. | 19/08/2021 |
| CVE-2021-28001 | 中5.4 | A cross-site scripting vulnerability was discovered in the Comments parameter in Textpattern CMS 4.8.4 which allows remote attackers to execute arbitrary code via a crafted payload entered into the URL field. The vulnerability is triggered by users visiting https://site.com/articles/welcome-to-your-site#comments-head. | 19/08/2021 |
| CVE-2020-23239 | 中4.8 | Cross Site Scripting (XSS) vulnerability in Textpattern CMS 4.8.1 via Custom fields in the Menu Preferences feature. | 26/07/2021 |
| CVE-2020-19510 | 緊急9.8 | Textpattern 4.7.3 contains an aribtrary file load via the file_insert function in include/txp_file.php. | 21/06/2021 |
| CVE-2021-30209 | 中6.5 | Textpattern V4.8.4 contains an arbitrary file upload vulnerability where a plug-in can be loaded in the background without any security verification, which may lead to obtaining system permissions. | 15/04/2021 |
| CVE-2020-35854 | 中4.8 | Textpattern 4.8.4 is affected by cross-site scripting (XSS) in the Body parameter. | 26/01/2021 |
| CVE-2020-29458 | 高8.8 | Textpattern CMS 4.6.2 allows CSRF via the prefs subsystem. | 02/12/2020 |
| CVE-2015-8033 | 中5.3 | In Textpattern 4.5.7, the password-reset feature does not securely tether a hash to a user account. | 14/08/2020 |
| CVE-2015-8032 | 中5.3 | In Textpattern 4.5.7, an unprivileged author can change an article's markup setting. | 14/08/2020 |
| CVE-2018-7474 | 緊急9.8 | An issue was discovered in Textpattern CMS 4.6.2 and earlier. It is possible to inject SQL code in the variable "qty" on the page index.php. | 14/03/2018 |