PT-2020-17124

Name of the Vulnerable Software and Affected Versions CXUUCMS version V3 Description The issue allows for XSS via the first and third input fields to "/public/admin.php". This means an attacker can inject malicious scripts into the website, potentially stealing user data or taking control of the...

CVE-2020-29250: Improper Neutralization of Input During Web Page Generation

CXUUCMS V3 allows XSS via the first and third input fields to /public/admin.php...

CVE-2020-35346

CXUUCMS V3 3.1 is affected by a reflected XSS vulnerability that allows remote attackers to inject arbitrary web script or HTML via the imgurl parameter of admin.php?c=content&a=add...

Cross site scripting

CXUUCMS V3 3.1 is affected by a reflected XSS vulnerability that allows remote attackers to inject arbitrary web script or HTML via the imgurl parameter of admin.php?c=content&a=add...

Cross site request forgery (csrf)

CXUUCMS V3 3.1 has a CSRF vulnerability that can add an administrator account via admin.php?c=adminuser&a=add...

CVE-2020-35347

CXUUCMS V3 3.1 has a CSRF vulnerability that can add an administrator account via admin.php?c=adminuser&a=add...

CVE-2020-35347

CXUUCMS V3 3.1 has a CSRF vulnerability that can add an administrator account via admin.php?c=adminuser&a=add...

CVE-2020-35346

CXUUCMS V3.1 is affected by a reflected cross-site scripting (XSS) flaw originating from the imgurl parameter in admin.php?c=content&a=add. The vulnerability allows remote attackers to inject arbitrary web script or HTML, as described across multiple sources (NVD, Red Hat, CNVD, CNVD-derived entr...

CVE-2020-35346

CXUUCMS V3 3.1 is affected by a reflected XSS vulnerability that allows remote attackers to inject arbitrary web script or HTML via the imgurl parameter of admin.php?c=content&a=add...

CVE-2020-35346

CXUUCMS V3 3.1 is affected by a reflected XSS vulnerability that allows remote attackers to inject arbitrary web script or HTML via the imgurl parameter of admin.php?c=content&a=add...

CVE-2020-35347: Cross-Site Request Forgery (CSRF)

CXUUCMS V3 3.1 has a CSRF vulnerability that can add an administrator account via admin.php?c=adminuser&a=add...

PT-2020-17312

Name of the Vulnerable Software and Affected Versions CXUUCMS V3 version 3.1 Description The issue allows an attacker to add an administrator account via a CSRF vulnerability. This can be exploited through the "admin.php?c=adminuser&a=add" endpoint. Recommendations For CXUUCMS V3 version 3.1, as ...

PT-2020-17311

Name of the Vulnerable Software and Affected Versions CXUUCMS V3 version 3.1 Description The issue allows remote attackers to inject arbitrary web script or HTML via the imgurl parameter of "admin.php?c=content&a=add". This enables attackers to perform a reflected XSS attack. Recommendations For...

CVE-2020-35346: Improper Neutralization of Input During Web Page Generation

CXUUCMS V3 3.1 is affected by a reflected XSS vulnerability that allows remote attackers to inject arbitrary web script or HTML via the imgurl parameter of admin.php?c=content&a=add...

Code injection

Jaws through 1.8.0 allows remote authenticated administrators to execute arbitrary code via crafted use of admin.php?reqGadget=Components&reqAction=InstallGadget&comp=FileBrowser and admin.php?reqGadget=FileBrowser&reqAction=Files to upload a .php file. NOTE: this is unrelated to the JAWS aka Job...

CVE-2020-35656

CVE-2020-35656 affects Jaws (CMS) up to version 1.8.0. The vulnerability arises from crafted requests to admin.php?reqGadget=Components&reqAction=InstallGadget&comp=FileBrowser and admin.php?reqGadget=FileBrowser&reqAction=Files, which allow an authenticated administrator to upload a .php file an...

PT-2020-17376

Name of the Vulnerable Software and Affected Versions Jaws versions 1.8.0 and earlier Description The issue allows remote authenticated administrators to execute arbitrary code via crafted use of "admin.php?reqGadget=Components&reqAction=InstallGadget&comp=FileBrowser" and...

CVE-2020-35656: Unrestricted Upload of File with Dangerous Type

Jaws through 1.8.0 allows remote authenticated administrators to execute arbitrary code via crafted use of admin.php?reqGadget=Components&reqAction=InstallGadget&comp=FileBrowser and admin.php?reqGadget=FileBrowser&reqAction=Files to upload a .php file. NOTE: this is unrelated to the JAWS aka Job...

PT-2020-17138

Name of the Vulnerable Software and Affected Versions SabaiApp Directories Pro plugin version 1.3.45 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via a POST to "/wp-admin/admin.php?page=drts/directories&q=%2F" with the drts form build...

CVE-2020-29303: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability in the SabaiApp Directories Pro plugin 1.3.45 for WordPress allows remote attackers to inject arbitrary web script or HTML via a POST to /wp-admin/admin.php?page=drts/directories&q=%2F with drtsformbuildid parameter containing the XSS payload and t paramet...