CVE-2025-28367

< 2.9.1.0

mojoPortal <=2.9.0.1 is vulnerable to Directory Traversal via BetterImageGallery API Controller - ImageHandler Action. An attacker

6.5MEDIUM

CVE-2023-44012

all versions

Cross Site Scripting vulnerability in mojoPortal v.2.7.0.0 allows a remote attacker to execute arbitrary code via the helpkey para

6.1MEDIUM

CVE-2023-44011

all versions

An issue in mojoPortal v.2.7.0.0 allows a remote attacker to execute arbitrary code via a crafted script to the layout.master skin

9.8CRITICAL

CVE-2023-44009

all versions

File Upload vulnerability in mojoPortal v.2.7.0.0 allows a remote attacker to execute arbitrary code via the Skin Management funct

9.8CRITICAL

CVE-2023-44008

all versions

File Upload vulnerability in mojoPortal v.2.7.0.0 allows a remote attacker to execute arbitrary code via the File Manager function

9.8CRITICAL

CVE-2023-24689

all versions

An issue in Mojoportal v2.7.0.0 and below allows an authenticated attacker to list all css files inside the root path of the webse

4.3MEDIUM

CVE-2023-24688

all versions

An issue in Mojoportal v2.7.0.0 allows an unauthenticated attacker to register a new user even if the Allow User Registrations fea

5.3MEDIUM

CVE-2023-24687

all versions

Mojoportal v2.7.0.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Company Info Settings compo

5.4MEDIUM

CVE-2023-24323

all versions

Mojoportal v2.7 was discovered to contain an authenticated XML external entity (XXE) injection vulnerability.

8.8HIGH

CVE-2023-24322

all versions

A reflected cross-site scripting (XSS) vulnerability in the FileDialog.aspx component of mojoPortal v2.7.0.0 allows attackers to e

6.1MEDIUM

CVE-2022-40123

all versions

mojoPortal v2.7 was discovered to contain a path traversal vulnerability via the "f" parameter at /DesignTools/CssEditor.aspx. Thi

6.5MEDIUM

CVE-2022-40341

all versions

mojoPortal v2.7 was discovered to contain an arbitrary file upload vulnerability which allows attackers to execute arbitrary code

8.8HIGH

CVE-2018-7447

<= 2.6.0.0

mojoPortal through 2.6.0.0 is prone to multiple persistent cross-site scripting vulnerabilities because it fails to sanitize user-

4.8MEDIUM

CVE-2017-1000457

all versions

Cross-site scripting (XSS) vulnerability in Help.aspx in mojoPortal version 2.5.0.0 allows remote attackers to inject arbitrary we

4.8MEDIUM

CVE-2013-5320

<= 2.3.9.7

Cross-site scripting (XSS) vulnerability in Forums/EditPost.aspx in mojoPortal before 2.3.9.8 allows remote attackers to inject ar

CVE-2010-3603

all versions

Cross-site request forgery (CSRF) vulnerability in the file manager service (Services/FileService.ashx) in mojoPortal 2.3.4.3 and

CVE-2010-3602

all versions

Cross-site scripting (XSS) vulnerability in ProfileView.aspx in mojoPortal 2.3.4.3 and 2.3.5.1 allows remote attackers to inject a