111 matches found
PT-2020-10773 · Gila · Gila Cms
Name of the Vulnerable Software and Affected Versions: Gila CMS versions prior to 1.11.6 Description: The issue is related to reflected XSS, which occurs via the id parameter in the admin/content/postcategory endpoint. This parameter is mishandled when g preview theme is used. Recommendations: Fo...
PT-2020-7208
Name of the Vulnerable Software and Affected Versions Axous versions 1.1.1 and earlier Description Multiple cross-site request forgery CSRF and cross-site scripting XSS issues allow remote attackers to hijack the authentication of administrators for requests. This can be done via various paramete...
Cross site scripting
Windu CMS 2.2 allows XSS via the name parameter to admin/content/edit or admin/content/add, or the username parameter to admin/users...
CVE-2013-7474
Windu CMS 2.2 is affected by a Cross-Site Scripting (XSS) vulnerability. The flaw allows injection via the name parameter in admin/content/edit or admin/content/add, or via the username parameter in admin/users. The NVD records show a CVSS base score of 4.3 (CS: Partial integrity impact, Network ...
CVE-2013-7474: Improper Neutralization of Input During Web Page Generation
Windu CMS 2.2 allows XSS via the name parameter to admin/content/edit or admin/content/add, or the username parameter to admin/users...
PT-2019-7023
Name of the Vulnerable Software and Affected Versions Windu CMS version 2.2 Description The issue allows for cross-site scripting XSS attacks. This can be achieved via the name parameter to 'admin/content/edit' or 'admin/content/add' API endpoints, or the username parameter to the 'admin/users'...
CVE-2018-19849
An issue was discovered in YzmCMS 5.2. XSS exists via the admin/content/search.html searinfo parameter...
CVE-2018-19849
CVE-2018-19849 concerns YzmCMS 5.2 where an XSS vulnerability exists in the admin/content/search.html page via the searinfo parameter. The issue arises from unsanitized input in that parameter, enabling script/HTML injection. Exploitation details are not provided in the connected documents; no pa...
CVE-2018-19849
An issue was discovered in YzmCMS 5.2. XSS exists via the admin/content/search.html searinfo parameter...
CVE-2018-19849
An issue was discovered in YzmCMS 5.2. XSS exists via the admin/content/search.html searinfo parameter...
PT-2018-15128
Name of the Vulnerable Software and Affected Versions YzmCMS version 5.2 Description An issue exists in the software where XSS is possible via the searinfo parameter in the "admin/content/search.html" endpoint. Recommendations For YzmCMS version 5.2, consider restricting access to the searinfo...
CVE-2018-19849: Improper Neutralization of Input During Web Page Generation
An issue was discovered in YzmCMS 5.2. XSS exists via the admin/content/search.html searinfo parameter...
YzmCMS Cross-Site Scripting Vulnerability (CNVD-2018-26781)
YzmCMS is an open source CMS Content Management System developed by Chinese programmer Yuan Zhimeng. A cross-site scripting vulnerability exists in YzmCMS version 5.2, which can be exploited by a remote attacker to inject arbitrary Web script or HTML by sending the 'searinfo' parameter to the...
CVE-2018-19544
JEECMS 9.3 has CSRF via the api/admin/content/save URI to add news...
CVE-2018-19544: Cross-Site Request Forgery (CSRF)
JEECMS 9.3 has CSRF via the api/admin/content/save URI to add news...
PT-2018-14989
Name of the Vulnerable Software and Affected Versions JEECMS version 9.3 Description The issue allows for CSRF via the "api/admin/content/save" API endpoint to add news. Recommendations For JEECMS version 9.3, as a temporary workaround, consider restricting access to the "api/admin/content/save"...
XiaoCms Cross-Site Request Forgery Vulnerability
XiaoCms is a lightweight content management system CMS based on PHP and MySQL and capable of running on Linux, Windows and other platforms. XiaoCms 20141229 version of admin/index.php?c=content&a=add&catid=3 URL has a cross-site request forgery vulnerability, which can be exploited by remote...
Cross site request forgery (csrf)
An issue was discovered in XiaoCms 20141229. admin/index.php?c=content&a=add&catid=3 has CSRF, as demonstrated by entering news via the datacontent parameter...