20 matches found
CVE-2026-102776 Joomla Extension - svenbluege.de - Cross-site request forgery of list tasks of the backend in Event Gallery extension < 6.6.0
Joomla Extension - svenbluege.de - Cross-site request forgery of list tasks of the backend in Event Gallery extension 6.6.0 - Eight tasks which the buttons of the back-end lists call did not check the form token: setting the default payment method, shipping method, image type set, order status an...
CVE-2026-102776 Joomla Extension - svenbluege.de - Cross-site request forgery of list tasks of the backend in Event Gallery extension < 6.6.0
Joomla Extension - svenbluege.de - Cross-site request forgery of list tasks of the backend in Event Gallery extension 6.6.0 - Eight tasks which the buttons of the back-end lists call did not check the form token: setting the default payment method, shipping method, image type set, order status an...
EUVD-2026-92451
Joomla Extension - svenbluege.de - Cross-site request forgery of list tasks of the backend in Event Gallery extension 6.6.0 - Eight tasks which the buttons of the back-end lists call did not check the form token: setting the default payment method, shipping method, image type set, order status an...
GHSA-VGP4-2FC4-QFF2 Winter: Stored XSS through Editor Settings custom styles
Impact Authenticated Backend Users with the backend.manageeditor "Manage editor settings" permission can provide custom styles through Settings → Editor Settings → Markup Styles that are compiled through the LESS CSS parser and rendered on every backend page. Previously, the compiled output was n...
ZZCMS 代码注入漏洞
ZZCMS is a content management system CMS from the China ZZCMS team. A code injection vulnerability exists in ZZCMS version 2025, which stems from incorrect manipulation of the parameter icp in the back-end site settings module file /admin/siteconfig.php, which may lead to code injection...
EUVD-2006-1118
Malware in sbrugna...
Cross-Site Request Forgery (CSRF)
typo3/cms-dashboard is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability is due to improper validation of HTTP methods in state-changing actions and misconfigurations in the backend settings, such as disabled security.backend.enforceReferrer or lax/none BE/cookieSameSite settings,...
CVE-2024-32167
Sourcecodester Online Medicine Ordering System 1.0 is vulnerable to Arbitrary file deletion vulnerability as the backend settings have the function of deleting pictures to delete any files...
CVE-2024-32167
Sourcecodester Online Medicine Ordering System 1.0 is vulnerable to Arbitrary file deletion vulnerability as the backend settings have the function of deleting pictures to delete any files...
CVE-2024-32167: Undefined Security Weakness
Sourcecodester Online Medicine Ordering System 1.0 is vulnerable to Arbitrary file deletion vulnerability as the backend settings have the function of deleting pictures to delete any files...
CVE-2024-32167
Sourcecodester Online Medicine Ordering System 1.0 is vulnerable to Arbitrary file deletion vulnerability as the backend settings have the function of deleting pictures to delete any files...
CVE-2024-32167
Sourcecodester Online Medicine Ordering System 1.0 is vulnerable to Arbitrary file deletion vulnerability as the backend settings have the function of deleting pictures to delete any files...
PT-2024-24454 · Unknown · Sourcecodester Online Medicine Ordering System
Name of the Vulnerable Software and Affected Versions: Sourcecodester Online Medicine Ordering System version 1.0 Description: The issue allows for arbitrary file deletion due to a function in the backend settings that can delete any files, initially intended for deleting pictures. Recommendation...
Insecure Deserialization
typo3/cms-core is vulnerable to insecure deserialization. The vulnerability exists as $BEUSER-uc in the backend settings is not properly handled...
CVE-2017-14049
In BlackCat CMS 1.2, backend/settings/ajaxsavesettings.php allows remote authenticated users to conduct XSS attacks via the Website header or Website footer field...
PT-2017-13223
Name of the Vulnerable Software and Affected Versions BlackCat CMS version 1.2 Description The issue allows remote authenticated users to conduct cross-site scripting XSS attacks. This can be achieved via the Website header or Website footer field in the backend/settings/ajax save settings.php...
CVE-2017-14049: Improper Neutralization of Input During Web Page Generation
In BlackCat CMS 1.2, backend/settings/ajaxsavesettings.php allows remote authenticated users to conduct XSS attacks via the Website header or Website footer field...
BlackCat CMS Cross-Site Scripting Vulnerability (CNVD-2017-24888)
BlackCat CMS is a PHP5, HTML5 content management system. A cross-site scripting vulnerability exists in the backend/settings/ajaxsavesettings.php file in BlackCat CMS, which can be exploited by remote attackers via the site title or site footer fields...
CVE-2006-1114
Multiple directory traversal vulnerabilities in Loudblog before 0.42 allow remote attackers to read or include arbitrary files via a .. dot dot and trailing %00 NULL byte in the 1 template and 2 page parameters in a index.php, and the 3 language parameter in b inc/backendsettings.php...
LoudBlog <= 0.4 arbitrary remote inclusion
------------- LoudBlog = 0.4 arbitrary remote inclusion ----------- software: site: http://loudblog.de/ description: "Loudblog is a sleek and easy-to-use Content Management System CMS for publishing media content on the web. It automatically generates a skinnable website and an RSS-Feed for...