Zenario vulnerabilities

2 known vulnerabilities in Zenario from Tribalsystems. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  zenario: Improper Control of Generation of Code

  CVE-2024-34461May 4, 2024Tribalsystems

  Zenario before 9.5.60437 uses Twig filters insecurely in the Twig Snippet plugin, and in the site-wide HEAD and BODY elements, enabling code execution by a designer or an administrator.

• 7.2 High severity

  Zenario CMS: Unrestricted Upload of File with Dangerous Type

  CVE-2022-23043Feb 24, 2022Zenario CMSEPSS 1.46%

  Zenario CMS 9.2 allows an authenticated admin user to bypass the file upload restriction by creating a new 'File/MIME Types' using the '.phar' extension. Then an attacker can upload a malicious file, intercept the request and change the extension to '.phar' in