88 matches found
Arbitrary File Upload
Overview Affected versions of this package are vulnerable to Arbitrary File Upload at the /admin/media/upload, which checks file types in the upload function. An authenticated user with the browsemedia privilege can provide a file spoofing one of the allowedMimeTypes, that contains malicious code...
Exploit for Cross-site Scripting in Boidcms
CVE-2024-53255 boid CMS 2.1.1 - reflected Cross-Site Scripting...
BoidCMS 安全漏洞
BoidCMS is a free open source flat file CMS from BoidCMS Open Source for building simple websites and blogs, developed in PHP and using JSON as the database. A security vulnerability exists in BoidCMS 2.1.1 and earlier versions, which stems from a Reflected Cross-Site Scripting XSS vulnerability ...
PT-2024-38673 · Dedebiz · Dedebiz
Name of the Vulnerable Software and Affected Versions: DedeBIZ version 6.3.0 Description: A critical vulnerability was found in DedeBIZ, affecting an unknown functionality of the file admin/media add.php of the component File Extension Handler. The manipulation of the argument upfile1 leads to...
DedeBIZ 安全漏洞
DedeBIZ is a content management system from China Muyun Intelligence DedeBIZ company. A security vulnerability exists in DedeBIZ version 6.3.0, which stems from the parameter upfile1 in the file admin/mediaadd.php that can lead to unrestricted uploads...
CVE-2023-41623
Emlog version pro2.1.14 was discovered to contain a SQL injection vulnerability via the uid parameter at /admin/media.php...
Sql injection
Emlog version pro2.1.14 was discovered to contain a SQL injection vulnerability via the uid parameter at /admin/media.php...
Emlog 安全漏洞
emlog is a PHP and MySQL based CMS builder for emlog personal developers. Emlog pro2.1.14 version of a security vulnerability, the vulnerability stems from the uid parameter in /admin/media.php contains SQL injection vulnerability. Attackers can use this vulnerability to gain unauthorized access ...
PT-2023-28005 · Emlog · Emlog
Name of the Vulnerable Software and Affected Versions: Emlog version pro2.1.14 Description: A SQL injection issue was discovered via the uid parameter at the "/admin/media.php" API endpoint. This allows for potential exploitation. Recommendations: For Emlog version pro2.1.14, consider restricting...
Cross-site Scripting (XSS)
Overview camaleoncms is a dynamic and advanced content management system based on Ruby on Rails as an alternative to Wordpress. Affected versions of this package are vulnerable to Cross-site Scripting XSS when the profile image in the User settings section can be run in the update or in the uploa...
GHSA-7F84-9CQF-G4J9 Camaleon CMS vulnerable to Stored Cross-site Scripting
In the 2.4 version of Camaleon CMS, Stored XSS has been discovered. The profile image in the User settings section can be run in the update / upload area via /admin/media/upload?actions=false...
BloofoxCms 代码问题漏洞
BloofoxCms is alexlang24 BloofoxCms individual developers of a Php-based text content management system. BloofoxCms 0.5.2.1 version has a security vulnerability, the vulnerability stems from the existence of arbitrary file upload vulnerability via...
CVE-2020-20670: Unrestricted Upload of File with Dangerous Type
An arbitrary file upload vulnerability in /admin/media/upload of ZKEACMS V3.2.0 allows attackers to execute arbitrary code via a crafted HTML file...
PT-2021-10527
Name of the Vulnerable Software and Affected Versions: ZKEACMS version 3.2.0 Description: An arbitrary file upload issue in the "/admin/media/upload" API endpoint allows attackers to execute arbitrary code via a crafted HTML file. Recommendations: For ZKEACMS version 3.2.0, consider disabling the...
ZKEACMS 代码问题漏洞
ZKEACMS is an open source visually designed, WYSIWYG content management system. version 3.2.0 of ZKEACMS contains a security vulnerability that stems from an arbitrary file upload vulnerability in the application's "/admin/media/upload", which could be exploited to execute arbitrary code via a...
CVE-2011-2933: Unrestricted Upload of File with Dangerous Type
An Arbitrary File Upload vulnerability exists in admin/media/upload.php in WebsiteBaker 2.8.1 and earlier due to a failure to restrict uploaded files with .htaccess, .php4, .php5, and .phtl extensions...
PT-2020-7112
Name of the Vulnerable Software and Affected Versions WebsiteBaker versions 2.8.1 and earlier Description An Arbitrary File Upload issue exists due to a failure to restrict uploaded files with certain extensions, such as .htaccess, .php4, .php5, and .phtl. This issue is related to the...
CVE-2020-5512
Gila CMS 1.11.8 allows /admin/media?path=../ Path Traversal...
