Cross site scripting

AeroCMS v0.0.1 was discovered to contain a stored cross-site scripting XSS vulnerability via viewallcomments.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Comments text field...

CVE-2022-27063

AeroCMS v0.0.1 was discovered to contain a stored cross-site scripting XSS vulnerability via viewallcomments.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Comments text field...

CVE-2022-27063

AeroCMS v0.0.1 contains a stored XSS vulnerability in view_all_comments.php. The issue arises from unsanitized input in the Comments text field, allowing attackers to inject arbitrary web scripts/HTML. Impact per sources includes arbitrary script execution and potential cookie access when admins ...

CVE-2022-27062

CVE-2022-27062 affects AeroCMS v0.0.1. The vulnerability is a stored cross-site scripting (XSS) in the Post Title field exposed via add_post.php, allowing an attacker to inject a crafted payload that executes arbitrary web scripts/HTML when rendered by the browser. The available sources consisten...

CVE-2022-27062

AeroCMS v0.0.1 was discovered to contain a stored cross-site scripting XSS vulnerability via addpost.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Post Title text field...

CVE-2022-27061

AeroCMS v0.0.1 was discovered to contain an arbitrary file upload vulnerability via the Post Image function under the Admin panel. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file...

CVE-2022-27061

CVE-2022-27061 relates to AeroCMS v0.0.1, where an arbitrary file upload vulnerability exists in the Admin panel’s Post Image function. The root cause is unsafeguarded handling of uploaded PHP files, enabling an attacker to upload a crafted PHP payload and achieve arbitrary code execution. Public...

AeroCMS 0.0.1 Shell Upload

AeroCMS-Unrestricted-File-Upload-POC Author: D4rkP0w4r Description = Upload web shell at Post Image in admin panel Step to Reproduct Login to admin panel - Posts - Add Posts - Post Image - upload malicious file shell.php - access /images/shell.php on url - shell.php page Exploit When upload succe...

AeroCMS 代码问题漏洞

AeroCMS is a content management system from AeroCMS, Inc. AeroCMS v0.0.1 is vulnerable to arbitrary file uploads, which can be exploited by attackers to execute arbitrary code via carefully crafted PHP files...

AeroCMS 0.0.1 Cross Site Scripting Vulnerability

AeroCMS-Comment-StoredXSS-POC Author: D4rkP0w4r Note = Don't need register or login account Description = StoredXSS at comment box Step to Reproduct Click Read More - input payload at Author - click Submit button Exploit Input payload at Author - click Submit button When admin login to admin pane...

AeroCMS 0.0.1 Cross Site Scripting

AeroCMS-Comment-StoredXSS-POC Author: D4rkP0w4r Note = Don't need register or login account Description = StoredXSS at comment box Step to Reproduct Click Read More - input payload at Author - click Submit button Exploit Input payload at Author - click Submit button When admin login to admin pane...

AeroCMS 跨站脚本漏洞

AeroCMS is a content management system from AeroCMS, Inc. A cross-site scripting vulnerability exists in AeroCMS v0.0.1, which can be exploited by attackers to execute arbitrary Web script or HTML by injecting a specially crafted payload into the post title text field...

AeroCMS 0.0.1 Shell Upload Exploit

AeroCMS-Unrestricted-File-Upload-POC Author: D4rkP0w4r Description = Upload web shell at Post Image in admin panel Step to Reproduct Login to admin panel - Posts - Add Posts - Post Image - upload malicious file shell.php - access /images/shell.php on url - shell.php page Exploit When upload succe...

AeroCMS 跨站脚本漏洞

AeroCMS is a content management system from AeroCMS, Inc. A cross-site scripting vulnerability exists in AeroCMS v0.0.1, which can be exploited to execute arbitrary Web script or HTML by injecting a specially crafted payload into the "comment" text field...