ZZCMS 跨站脚本漏洞

ZZZCMS is a content management system CMS from the ZZZCMS team in China. ZZZCMS suffers from a cross-site scripting vulnerability that stems from a lack of data validation filtering of user-supplied and output data in the editfile action of /adminxxx/save.php. An attacker could exploit the...

S-CMS 跨站脚本漏洞

S-CMS is a PHP and MySQL based Content Management System CMS from S-CMS, China. S-CMS suffers from a cross-site scripting vulnerability that stems from cross-site scripting XSS in S-CMS build 20191014 and earlier versions that allows remote attackers to execute arbitrary code via the Site Title...

bycms 跨站请求伪造漏洞

bycms is a simple, easy-to-use content management system. A cross-site request forgery vulnerability exists in bycms v1.3, which can be triggered by an attacker via admin.php/systems/index/moduleid/70/groupid/1.html...

CVE-2020-22206

SQL Injection in ECShop 3.0 via the aid parameter to admin/affiliateck.php...

CVE-2020-36005

AppCMS 2.0.101 in /admin/app.php has an arbitrary file deletion vulnerability which allows attackers to delete arbitrary files on the site...

CVE-2021-29439

The Grav admin plugin prior to version 1.10.11 does not correctly verify caller's privileges. As a consequence, users with the permission admin.login can install third-party plugins and their dependencies. By installing the right plugin, an attacker can obtain an arbitrary code execution primitiv...

PT-2021-18215 · Grav · Grav Admin Plugin

Name of the Vulnerable Software and Affected Versions: Grav admin plugin versions prior to 1.10.11 Description: The issue arises from incorrect verification of caller's privileges, allowing users with the admin.login permission to install third-party plugins and their dependencies. This can lead ...

Smartstore SmartStoreNET 跨站请求伪造漏洞

Smartstore SmartStoreNET is an open source e-commerce Web platform of Germany Smartstore company . The platform includes CRM, CMS, sales, marketing, payment, order processing and other functions. A cross-site request forgery vulnerability exists in Smartstore SmartStoreNET versions prior to 4.1.0...

CVE-2019-16997

In Metinfo 7.0.0beta, a SQL Injection was discovered in app/system/language/admin/languagegeneral.class.php via the admin/?n=language&c=languagegeneral&a=doExportPack appno parameter...

CVE-2019-9912

The wp-google-maps plugin before 7.10.43 for WordPress has XSS via the wp-admin/admin.php PATHINFO...

LFCMS Directory Traversal Vulnerability

Lei Feng TV CMS aka LFCMS is a video-on-demand system developed using PHP and MySQL. LFCMS version 3.8.6 of http://www.a.com:84/admin.php?s=/Template/index.html页面存在目录遍历漏洞. An attacker can exploit this vulnerability with the help of the '...' sequence in the Template/edit/path URIs. ' sequence in...

DamiCMS Arbitrary File Read Vulnerability

DamiCMS is a content management system CMS for building websites quickly. A security vulnerability exists in DamiCMS version 6.0.1. A remote attacker can exploit the vulnerability by sending a specially crafted request admin.php?s=Tpl/Add/id to read arbitrary files...

tp5cms cross-site scripting vulnerability (CNVD-2018-26479)

tp5cms is a content management system CMS framework written in the PHP language and based on technologies such as ThinkPHP, swiper and bootstrap. A cross-site scripting vulnerability exists in the admin.php/system/set.html page in tp5cms 2017-05-25 and earlier versions. A remote attacker can...

CVE-2018-18773

CentOS-WebPanel.com aka CWP CentOS Web Panel through 0.9.8.740 allows CSRF via admin/index.php?module=rootpwd, as demonstrated by changing the root password...

XiaoCms Information Disclosure Vulnerability

XiaoCms is a lightweight content management system CMS based on PHP and MySQL and capable of running on Linux, Windows and other platforms. A security vulnerability exists in /admin/index.php?c=database in XiaoCms version 20141229. The vulnerability can be exploited to obtain the full path with t...

CVE-2018-18741

An XSS issue was discovered in SEMCMS 3.4 via admin/SEMCMSDownload.php?lgid=1 during editing...

YUNUCMS cross-site scripting vulnerability (CNVD-2018-23278)

YUNUCMS is a three-network, self-substation system of open source content management system. YUNUCMS 1.1.5 in admin/sitelink/editsitelink?id=16 cross-site scripting vulnerability, attackers can exploit the vulnerability to carry out cross-site attacks...

Catfish CMS Cross-Site Request Forgery Vulnerability

Catfish CMS is an open source content management system CMS written in PHP. A cross-site request forgery vulnerability exists in the admin/Index/addmanageuser.html page in Catfish CMS version 4.8.30, which can be exploited by remote attackers to add users...

CVE-2018-18420

Cross-Site Request Forgery CSRF vulnerability was discovered in the 8.3 version of Zenario Content Management System via the admin/organizer.ajax.php?path=zenariocontent%2Fpanels%2Fcontent URI...

Hot Drama CMS v2.1 has a flawed logic vulnerability

Hot Drama CMS is a movie and TV station building system developed by PHP+MySQL. There is a logic flaw vulnerability in /admin/cm.php in Hot Drama CMS v2.1, which can be exploited by an attacker to log in to the administration background by modifying the cookie value...