Search
Find a vulnerability
Search criteria
6 vulnerabilities by D-ZERO CO.,LTD.
CVE-2026-84063 (GCVE-0-2026-84063)
Vulnerability from nvd – Published: 2026-09-10 02:15 – Updated: 2026-09-10 17:41
VLAI
EPSS
VEX
Summary
BurgerEditor 3.2.0 through 3.4.0 contains an issue with unrestricted upload of file with dangerous type. If this vulnerability is exploited, an arbitrary file may be uploaded by an attacker who can log in to the product, potentially allowing arbitrary PHP code to be executed may be caused.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-10 17:39 UTC
CWE
- CWE-434 - Unrestricted upload of file with dangerous type
Assigner
References
2 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| D-ZERO CO.,LTD. | BurgerEditor |
Affected:
3.2.0 through 3.4.0
|
|
| D-ZERO CO.,LTD. | BurgerEditor |
Affected:
2.28.0 through 2.30.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-84063",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-10T17:39:46.164484Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T17:41:24.347Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "BurgerEditor",
"vendor": "D-ZERO CO.,LTD.",
"versions": [
{
"status": "affected",
"version": "3.2.0 through 3.4.0"
}
]
},
{
"product": "BurgerEditor",
"vendor": "D-ZERO CO.,LTD.",
"versions": [
{
"status": "affected",
"version": "2.28.0 through 2.30.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "BurgerEditor 3.2.0 through 3.4.0 contains an issue with unrestricted upload of file with dangerous type. If this vulnerability is exploited, an arbitrary file may be uploaded by an attacker who can log in to the product, potentially allowing arbitrary PHP code to be executed may be caused."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
"version": "3.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 8.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "Unrestricted upload of file with dangerous type",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T02:15:36.298Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://jvn.jp/en/jp/JVN21088484/"
},
{
"url": "https://burger.d-zero.co.jp/blogs/archives/3"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2026-84063",
"datePublished": "2026-09-10T02:15:36.298Z",
"dateReserved": "2026-09-01T05:55:36.966Z",
"dateUpdated": "2026-09-10T17:41:24.347Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-84062 (GCVE-0-2026-84062)
Vulnerability from nvd – Published: 2026-09-10 02:15 – Updated: 2026-09-10 17:44
VLAI
EPSS
VEX
Summary
BurgerEditor 3.0.0 through 3.4.0 contains an issue with authorization bypass through user-controlled key. If this vulnerability is exploited, the content of the page may be altered by an attacker who can log in to the product may be caused.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-10 17:43 UTC
CWE
- CWE-639 - Authorization bypass through user-controlled key
Assigner
References
2 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| D-ZERO CO.,LTD. | BurgerEditor |
Affected:
3.0.0 through 3.4.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-84062",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-10T17:43:49.596319Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T17:44:36.414Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "BurgerEditor",
"vendor": "D-ZERO CO.,LTD.",
"versions": [
{
"status": "affected",
"version": "3.0.0 through 3.4.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "BurgerEditor 3.0.0 through 3.4.0 contains an issue with authorization bypass through user-controlled key. If this vulnerability is exploited, the content of the page may be altered by an attacker who can log in to the product may be caused."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization bypass through user-controlled key",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T02:15:14.043Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://jvn.jp/en/jp/JVN21088484/"
},
{
"url": "https://burger.d-zero.co.jp/blogs/archives/3"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2026-84062",
"datePublished": "2026-09-10T02:15:14.043Z",
"dateReserved": "2026-09-01T05:55:36.965Z",
"dateUpdated": "2026-09-10T17:44:36.414Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-84063 (GCVE-0-2026-84063)
Vulnerability from cvelistv5 – Published: 2026-09-10 02:15 – Updated: 2026-09-10 17:41
VLAI
EPSS
VEX
Summary
BurgerEditor 3.2.0 through 3.4.0 contains an issue with unrestricted upload of file with dangerous type. If this vulnerability is exploited, an arbitrary file may be uploaded by an attacker who can log in to the product, potentially allowing arbitrary PHP code to be executed may be caused.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-10 17:39 UTC
CWE
- CWE-434 - Unrestricted upload of file with dangerous type
Assigner
References
2 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| D-ZERO CO.,LTD. | BurgerEditor |
Affected:
3.2.0 through 3.4.0
|
|
| D-ZERO CO.,LTD. | BurgerEditor |
Affected:
2.28.0 through 2.30.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-84063",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-10T17:39:46.164484Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T17:41:24.347Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "BurgerEditor",
"vendor": "D-ZERO CO.,LTD.",
"versions": [
{
"status": "affected",
"version": "3.2.0 through 3.4.0"
}
]
},
{
"product": "BurgerEditor",
"vendor": "D-ZERO CO.,LTD.",
"versions": [
{
"status": "affected",
"version": "2.28.0 through 2.30.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "BurgerEditor 3.2.0 through 3.4.0 contains an issue with unrestricted upload of file with dangerous type. If this vulnerability is exploited, an arbitrary file may be uploaded by an attacker who can log in to the product, potentially allowing arbitrary PHP code to be executed may be caused."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
"version": "3.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 8.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "Unrestricted upload of file with dangerous type",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T02:15:36.298Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://jvn.jp/en/jp/JVN21088484/"
},
{
"url": "https://burger.d-zero.co.jp/blogs/archives/3"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2026-84063",
"datePublished": "2026-09-10T02:15:36.298Z",
"dateReserved": "2026-09-01T05:55:36.966Z",
"dateUpdated": "2026-09-10T17:41:24.347Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-84062 (GCVE-0-2026-84062)
Vulnerability from cvelistv5 – Published: 2026-09-10 02:15 – Updated: 2026-09-10 17:44
VLAI
EPSS
VEX
Summary
BurgerEditor 3.0.0 through 3.4.0 contains an issue with authorization bypass through user-controlled key. If this vulnerability is exploited, the content of the page may be altered by an attacker who can log in to the product may be caused.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-10 17:43 UTC
CWE
- CWE-639 - Authorization bypass through user-controlled key
Assigner
References
2 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| D-ZERO CO.,LTD. | BurgerEditor |
Affected:
3.0.0 through 3.4.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-84062",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-10T17:43:49.596319Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T17:44:36.414Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "BurgerEditor",
"vendor": "D-ZERO CO.,LTD.",
"versions": [
{
"status": "affected",
"version": "3.0.0 through 3.4.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "BurgerEditor 3.0.0 through 3.4.0 contains an issue with authorization bypass through user-controlled key. If this vulnerability is exploited, the content of the page may be altered by an attacker who can log in to the product may be caused."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization bypass through user-controlled key",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T02:15:14.043Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://jvn.jp/en/jp/JVN21088484/"
},
{
"url": "https://burger.d-zero.co.jp/blogs/archives/3"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2026-84062",
"datePublished": "2026-09-10T02:15:14.043Z",
"dateReserved": "2026-09-01T05:55:36.965Z",
"dateUpdated": "2026-09-10T17:44:36.414Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
JVNDB-2026-000129
Vulnerability from jvndb - Published: 2026-09-09 06:59 - Updated:2026-09-09 06:59
Severity
Summary
Multiple vulnerabilities in baserCMS plugin "BurgerEditor"
Details
baserCMS plugin "BurgerEditor" provided by D-ZERO CO.,LTD. contains multiple vulnerabilities listed below:
- Authorization Bypass Through User-Controlled Key (CWE-639) - CVE-2026-84062
- Unrestricted Upload of File with Dangerous Type (CWE-434) - CVE-2026-84063
References
Impacted products
| Vendor | Product | |
|---|---|---|
{
"@rdf:about": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-000129.html",
"dc:date": "2026-09-09T15:59+09:00",
"dcterms:issued": "2026-09-09T15:59+09:00",
"dcterms:modified": "2026-09-09T15:59+09:00",
"description": "baserCMS plugin \"BurgerEditor\" provided by D-ZERO CO.,LTD. contains multiple vulnerabilities listed below:\u003ca href=\u0027https://cwe.mitre.org/data/definitions/639.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003ca href=\u0027https://cwe.mitre.org/data/definitions/434.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003cul\u003e\u003cli\u003eAuthorization Bypass Through User-Controlled Key (CWE-639) - CVE-2026-84062\u003c/li\u003e\u003cli\u003eUnrestricted Upload of File with Dangerous Type (CWE-434) - CVE-2026-84063\u003c/li\u003e\u003c/ul\u003eKuniyoshi Noguchi @KuniNogu reported these vulnerabilities to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
"link": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-000129.html",
"sec:cpe": {
"#text": "cpe:/a:misc:d-zero_burger_editor",
"@product": "BurgerEditor",
"@vendor": "D-ZERO CO.,LTD.",
"@version": "2.2"
},
"sec:cvss": {
"@score": "6.5",
"@severity": "Medium",
"@type": "Base",
"@vector": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
"@version": "3.0"
},
"sec:identifier": "JVNDB-2026-000129",
"sec:references": [
{
"#text": "https://jvn.jp/en/jp/JVN21088484/index.html",
"@id": "JVN#21088484",
"@source": "JVN"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2026-84062",
"@id": "CVE-2026-84062",
"@source": "CVE"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2026-84063",
"@id": "CVE-2026-84063",
"@source": "CVE"
},
{
"#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
"@id": "CWE-Other",
"@title": "No Mapping(CWE-Other)"
}
],
"title": "Multiple vulnerabilities in baserCMS plugin \"BurgerEditor\""
}
JVNDB-2024-000109
Vulnerability from jvndb - Published: 2024-10-10 05:57 - Updated:2024-11-06 05:45
Severity
Summary
baserCMS plugin "BurgerEditor" vulnerable to directory listing
Details
baserCMS plugin "BurgerEditor" provided by D-ZERO CO.,LTD. contains a directory listing vulnerability (CWE-548, CVE-2024-44807).
If accessing a URL of the web site using the plugin that has a specific string added to the end, a list of uploaded files may be obtained.
In addition, the uploaded file itself may be obtained through the list information.
Koh You Liang of SOMPO Holdings and Orel Gispan of Sompo Digital Lab Tel Aviv reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
References
| Type | URL | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
Impacted products
| Vendor | Product | |
|---|---|---|
{
"@rdf:about": "https://jvndb.jvn.jp/en/contents/2024/JVNDB-2024-000109.html",
"dc:date": "2024-11-06T14:45+09:00",
"dcterms:issued": "2024-10-10T14:57+09:00",
"dcterms:modified": "2024-11-06T14:45+09:00",
"description": "baserCMS plugin \"BurgerEditor\" provided by D-ZERO CO.,LTD. contains a directory listing vulnerability (CWE-548, CVE-2024-44807).\r\nIf accessing a URL of the web site using the plugin that has a specific string added to the end, a list of uploaded files may be obtained.\r\nIn addition, the uploaded file itself may be obtained through the list information.\r\n\r\nKoh You Liang of SOMPO Holdings and Orel Gispan of Sompo Digital Lab Tel Aviv reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
"link": "https://jvndb.jvn.jp/en/contents/2024/JVNDB-2024-000109.html",
"sec:cpe": {
"#text": "cpe:/a:misc:d-zero_burger_editor",
"@product": "BurgerEditor",
"@vendor": "D-ZERO CO.,LTD.",
"@version": "2.2"
},
"sec:cvss": {
"@score": "5.3",
"@severity": "Medium",
"@type": "Base",
"@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"@version": "3.0"
},
"sec:identifier": "JVNDB-2024-000109",
"sec:references": [
{
"#text": "https://jvn.jp/en/jp/JVN54676967/index.html",
"@id": "JVN#54676967",
"@source": "JVN"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2024-44807",
"@id": "CVE-2024-44807",
"@source": "CVE"
},
{
"#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
"@id": "CWE-200",
"@title": "Information Exposure(CWE-200)"
}
],
"title": "baserCMS plugin \"BurgerEditor\" vulnerable to directory listing"
}