PT-2022-18377

Name of the Vulnerable Software and Affected Versions E-Commerce Website version 1.0 Description A cross-site scripting XSS issue in the "/public/admin/index.php?add product" API endpoint allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Product Tit...

CVE-2022-28056

ShopXO v2.2.5 and below was discovered to contain a system re-install vulnerability via the Add function in app/install/controller/Index.php...

CVE-2022-28056

ShopXO v2.2.5 and below was discovered to contain a system re-install vulnerability via the Add function in app/install/controller/Index.php...

CVE-2022-28056

ShopXO v2.2.5 and below was discovered to contain a system re-install vulnerability via the Add function in app/install/controller/Index.php...

CVE-2022-28056: Undefined Security Weakness

ShopXO v2.2.5 and below was discovered to contain a system re-install vulnerability via the Add function in app/install/controller/Index.php...

CVE-2022-28918

GreenCMS v2.3.0603 was discovered to contain an arbitrary file deletion vulnerability via /index.php?m=admin&c=custom&a=plugindelhandle&pluginname=...

CVE-2022-28918

GreenCMS v2.3.0603 was discovered to contain an arbitrary file deletion vulnerability via /index.php?m=admin&c=custom&a=plugindelhandle&pluginname=...

CVE-2022-28918

GreenCMS v2.3.0603 is affected by an arbitrary file deletion vulnerability exploitable over the network via /index.php?m=admin&c=custom&a=plugindelhandle&plugin_name=. The CVE entry indicates this allows deletion of arbitrary files, with CVSSv3.1 base score 8.1 (HIGH) and a network attack vector;...

CVE-2022-28528

bloofoxCMS v0.5.2.1 was discovered to contain an arbitrary file upload vulnerability via /admin/index.php?mode=content&page=media&action=edit...

CVE-2022-28523

HongCMS 3.0.0 allows arbitrary file deletion via the component /admin/index.php/template/ajax?action=delete...

CVE-2022-28522

ZCMS v20170206 contains a stored XSS vulnerability in index.php?m=home&c=message&a=add. The root cause is a stored cross-site scripting flaw in the message add endpoint, allowing injection that can affect other users. According to the provided sources, the impact is C=L/I=L (partial integrity imp...

CVE-2022-28521

CVE-2022-28521 affects ZCMS v20170206 (thinkphp-zcms). The vulnerability is a file inclusion flaw in index.php?m=home&c=home&a=sp_set_config that can lead to arbitrary code execution. Several sources (NVD, CNVD/CNNVD, Red Hat, PRION) corroborate the file inclusion risk; exploitation status is not...

CVE-2022-28521

ZCMS v20170206 was discovered to contain a file inclusion vulnerability via index.php?m=home&c=home&a=spsetconfig...

CVE-2022-28522: Improper Neutralization of Input During Web Page Generation

ZCMS v20170206 was discovered to contain a stored cross-site scripting XSS vulnerability via index.php?m=home&c=message&a=add...

PT-2022-19062

Name of the Vulnerable Software and Affected Versions ZCMS version v20170206 Description A stored cross-site scripting XSS issue was found in ZCMS. The issue is exploited via the index.php endpoint with specific parameters: m=home, c=message, and a=add. This allows for malicious script execution...

CVE-2022-28523: Improper Limitation of a Pathname to a Restricted Directory

HongCMS 3.0.0 allows arbitrary file deletion via the component /admin/index.php/template/ajax?action=delete...

CVE-2022-28521: Undefined Security Weakness

ZCMS v20170206 was discovered to contain a file inclusion vulnerability via index.php?m=home&c=home&a=spsetconfig...

PT-2022-19061

Name of the Vulnerable Software and Affected Versions ZCMS version v20170206 Description A file inclusion issue was discovered in ZCMS, which can be exploited via the "index.php" endpoint with specific parameters, including m, c, and a. The vulnerability is triggered when an attacker manipulates...

PT-2022-19063

Name of the Vulnerable Software and Affected Versions HongCMS version 3.0.0 Description The issue allows for arbitrary file deletion. This can be achieved via the component /admin/index.php/template/ajax?action=delete. Recommendations For HongCMS version 3.0.0, as a temporary workaround, consider...

PT-2022-19067

Name of the Vulnerable Software and Affected Versions bloofoxCMS version 0.5.2.1 Description The issue is related to an arbitrary file upload vulnerability. This vulnerability can be exploited via the "/admin/index.php?mode=content&page=media&action=edit" API endpoint. Recommendations For...