B2evolution vulnerabilities
We track 3 vulnerabilities in B2evolution products across 2 products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on September 17, 2026.
Latest B2evolution vulnerabilities
- 8.1 High severity
b2evolution CMS: Deserialization of Untrusted Data
b2evolution CMS versions 6.7.8 through 7.2.5 contain an incomplete fix for CVE-2016-8901 where the serialized-array object check in param_check_serialized_array() fails to reject payloads with negative integer array keys. Unauthenticated attackers can submit c
- 7.2 High severity
b2evolution_cms: Unrestricted Upload of File with Dangerous Type
In b2evolution 7.2.5, if configured with admins_can_manipulate_sensitive_files, arbitrary file upload is allowed for admins, leading to command execution. NOTE: the vendor's position is that this is "very obviously a feature not an issue and if you don't like
- 9.1 Critical severity
B2evolution: Use of Insufficiently Random Values
An authorization bypass in b2evolution allows remote, unauthenticated attackers to predict password reset tokens for any user through the use of a bad randomness function. This allows the attacker to get valid sessions for arbitrary users, and optionally reset