Stupid Simple CMS Security Vulnerability

Stupid Simple CMS is a content management system by codelyfe individual developer. A security vulnerability exists in Stupid Simple CMS version 1.2.4, which contains a cross-site request forgery CSRF vulnerability via the component /admin-edit.php...

PT-2024-19535 · Unknown · Stupid Simple Cms

Name of the Vulnerable Software and Affected Versions: Stupid Simple CMS versions =1.2.4 Description: A Cross-Site Request Forgery CSRF issue was discovered in the /admin-edit.php component. This allows for potential unauthorized actions on the affected system. Recommendations: For versions =1.2....

WordPress Ideal Interactive Map Plugin <= 1.2.4 is vulnerable to Cross Site Scripting (XSS)

Software Ideal Interactive Map Type Plugin Vulnerable versions = 1.2.4 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-52189 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID a837bcedc198 Credits Ngô Thiên An ancorn from VNPT-VCI...

Winter CMS Stored XSS through Backend ColorPicker FormWidget

Impact Users with access to backend forms that include a ColorPicker FormWidget can provide a value that would then be rendered unescaped in the backend form, potentially allowing for a stored XSS attack. By default, only the Brand Settings backend.managebranding and Mail Brand Settings...

GHSA-43W4-4J3C-JX29 Winter CMS Stored XSS through Backend ColorPicker FormWidget

Impact Users with access to backend forms that include a ColorPicker FormWidget can provide a value that would then be rendered unescaped in the backend form, potentially allowing for a stored XSS attack. By default, only the Brand Settings backend.managebranding and Mail Brand Settings...

Winter Cross-Site Scripting Vulnerability

Winter is a free, open source, self-hosted CMS platform based on the Laravel PHP framework. A cross-site scripting vulnerability exists in Winter versions prior to 1.2.4, which stems from the presence of a stored cross-site scripting XSS vulnerability...

PT-2023-31917 · Unknown · Winter Cms

Name of the Vulnerable Software and Affected Versions: Winter CMS versions prior to 1.2.4 Description: The issue concerns a Local File Inclusion vulnerability in Winter CMS, a free, open-source content management system. Users with access to backend forms that include a ColorPicker FormWidget can...

Winter Cross-Site Scripting Vulnerability

Winter is a free, open source, self-hosted CMS platform based on the Laravel PHP framework. A cross-site scripting vulnerability exists in Winter versions prior to 1.2.4, which stems from the presence of a stored cross-site scripting XSS vulnerability...

PT-2023-31916 · Unknown · Winter Cms

Name of the Vulnerable Software and Affected Versions: Winter CMS versions prior to 1.2.4 Description: The issue affects users with access to backend forms that include a ColorPicker FormWidget, allowing them to provide a value that would then be rendered unescaped in the backend form, potentiall...

PT-2023-32849 · Unknown · Codelyfe Stupid Simple Cms

Name of the Vulnerable Software and Affected Versions: codelyfe Stupid Simple CMS versions up to 1.2.4 Description: A critical issue has been found in the software, affecting some unknown functionality of the file /file-manager/rename.php. The manipulation of the newName argument leads to path...

Stupid Simple CMS Security Vulnerability

Stupid Simple CMS is a content management system by codelyfe individual developer. A security vulnerability exists in Stupid Simple CMS 1.2.4 and earlier versions, which stems from a path traversal vulnerability in the file /file-manager/rename.php...

Stupid Simple CMS Security Vulnerability

Stupid Simple CMS is a content management system by codelyfe individual developer. A security vulnerability exists in Stupid Simple CMS 1.2.4 and earlier versions, which stems from a path traversal vulnerability in the file /file-manager/rename.php...

CVE-2023-48766

Cross-Site Request Forgery CSRF vulnerability in SVGator SVGator – Add Animated SVG Easily.This issue affects SVGator – Add Animated SVG Easily: from n/a through 1.2.4...

PT-2023-32815 · Codelyfe · Codelyfe Stupid Simple Cms

Name of the Vulnerable Software and Affected Versions: codelyfe Stupid Simple CMS versions up to 1.2.4 Description: A critical issue has been found in the Deletion Interface component, specifically in the /file-manager/delete.php file. The manipulation of the file argument leads to improper...

Stupid Simple CMS Authorization Issues Vulnerability

Stupid Simple CMS is a content management system for codelyfe individual developers. Stupid Simple CMS 1.2.4 and earlier versions have an authorization issue vulnerability that stems from the parameter file in the file /file-manager/delete.php that causes incorrect authentication...

PT-2023-30947 · Svgator · Svgator

Name of the Vulnerable Software and Affected Versions: SVGator – Add Animated SVG Easily versions 1.2.4 and earlier Description: A Cross-Site Request Forgery CSRF issue has been identified. This type of issue allows an attacker to trick a user into performing unintended actions on a web applicati...

Stupid Simple CMS Code Issue Vulnerability

Stupid Simple CMS is a content management system by codelyfe individual developer. A code issue vulnerability exists in Stupid Simple CMS 1.2.4 and earlier versions, which stems from an arbitrary file upload vulnerability in file/file manager/upload.php...

CVE-2023-50266

Bazarr manages and downloads subtitles. In version 1.2.4, the proxy method in bazarr/bazarr/app/ui.py does not validate the user-controlled protocol and url variables and passes them to requests.get without any sanitization, which leads to a blind server-side request forgery SSRF. This issue allo...

Server side request forgery (ssrf)

Bazarr manages and downloads subtitles. In version 1.2.4, the proxy method in bazarr/bazarr/app/ui.py does not validate the user-controlled protocol and url variables and passes them to requests.get without any sanitization, which leads to a blind server-side request forgery SSRF. This issue allo...

CVE-2023-50266 Bazarr Blind Server-Side Request Forgery (SSRF) in the /test/<protocol>/ endpoint

Bazarr manages and downloads subtitles. In version 1.2.4, the proxy method in bazarr/bazarr/app/ui.py does not validate the user-controlled protocol and url variables and passes them to requests.get without any sanitization, which leads to a blind server-side request forgery SSRF. This issue allo...