Code execution vulnerability in Elefant CMS 2.0.8 backend

Elefant CMS is a PHP-based content management system CMS. The system includes features such as an events calendar, contact form, social media integration and member login. A code execution vulnerability exists in the Elefant CMS 2.0.8 backend at Add Language List, which stems from a failure to...

Command Execution Vulnerability in ITKEE Backend Management System

ITKEE backend management system is an open source system using thinkphp5+layui development . ITKEE backend management system has a command execution vulnerability that can be exploited by attackers to gain control of the web server...

Code Execution Vulnerabilities in the Backend of Yunyou CMS

YUNUCMS enterprise website management system YUNUCMS is a set of professional marketing enterprise building system based on PHP + MYSQL as the core development. A code execution vulnerability exists in the background of YUNUCMS, which can be exploited by attackers to gain control of the web serve...

SQL Injection Vulnerability in Di***.php Page of CloudYou CMS Backend

Yunyou CMS is a professional marketing enterprise building system based on PHP+MYSQL as the core development. SQL injection vulnerability exists in the background Di.php page of CloudUnion CMS, which can be exploited by attackers to obtain sensitive database information...

Code execution vulnerability in Elefant CMS 2.0.8 backend

Elefant CMS is a PHP-based content management system CMS. The system includes features such as an events calendar, contact form, social media integration and member login. A code execution vulnerability exists in Elefant CMS 2.0.8 at the backend template, which is caused due to a failure of stric...

CVE-2018-14623

A SQL injection flaw was found in katello's errata-related API. An authenticated remote attacker can craft input data to force a malformed SQL query to the backend database, which will leak internal IDs. This is issue is related to an incomplete fix for CVE-2016-3072. Version 3.10 and older is...

CVE-2018-14623

A SQL injection flaw was found in katello's errata-related API. An authenticated remote attacker can craft input data to force a malformed SQL query to the backend database, which will leak internal IDs. This is issue is related to an incomplete fix for CVE-2016-3072. Version 3.10 and older is...

CVE-2018-14623

A SQL injection flaw was found in katello's errata-related API. An authenticated remote attacker can craft input data to force a malformed SQL query to the backend database, which will leak internal IDs. This is issue is related to an incomplete fix for CVE-2016-3072. Version 3.10 and older is...

CVE-2018-14623

A SQL injection flaw was found in katello's errata-related API. An authenticated remote attacker can craft input data to force a malformed SQL query to the backend database, which will leak internal IDs...

Cross-Site Scripting in Backend Modal Component

More info at https://typo3.org/security/advisory/typo3-core-sa-2018-007...

Cross-Site Scripting in Backend Modal Component

More info at https://typo3.org/security/advisory/typo3-core-sa-2018-007...

zzzcms v1.5.8 Code Execution Vulnerability in Backend

zzcms is a free website builder developed in asp language. There is a code execution vulnerability in the backend of zzzcms v1.5.8. An attacker can exploit this vulnerability to execute arbitrary code...

Cross-Site Scripting in Backend Modal Component

Failing to properly encode user input, notifications shown in modal windows in the TYPO3 backend are vulnerable to cross-site scripting. A valid backend user account is needed in order to exploit this vulnerability...

Denial of Service in Online Media Asset Handling

Online Media Asset Handling .youtube and .vimeo files in the TYPO3 backend is vulnerable to denial of service. Putting large files with according file extensions results in high consumption of system resources. This can lead to exceeding limits of the current PHP process which results in a...

Weak Password Vulnerability in e5e Website Management System Wangzt 3.0.4 Enterprise Edition

Hunan Fifth Element Network Technology Development Co., Ltd. is a company specializing in Internet information services, enterprise application software development and e-commerce platform construction enterprises. Weak password vulnerability exists in e5e website management system Wangzt3.0.4...

Cross-Site Scripting in Online Media Asset Rendering

Failing to properly encode user input, online media asset rendering .youtube and .vimeo files is vulnerable to cross-site scripting. A valid backend user account or write access on the server system e.g. SFTP is needed in order to exploit this vulnerability...

Cross-Site Scripting in CKEditor

It has been discovered, that the third party library CKEditor is vulnerable to cross-site scripting. A valid backend user account is needed in order to exploit this vulnerability...

typo3 -- multiple vulnerabilities

Typo3 core team reports: CKEditor 4.11 fixes an XSS vulnerability in the HTML parser reported by maxarr. The vulnerability stemmed from the fact that it was possible to execute XSS inside the CKEditor source area after persuading the victim to: i switch CKEditor to source mode, then ii paste a...

CVE-2018-16635

Blackcat CMS 1.3.2 allows XSS via the willkommen.php?lang=DE page title at backend/pages/modify.php...

CVE-2018-16635

CVE-2018-16635 affects Blackcat CMS 1.3.2 and is an XSS vulnerability exposed via the willkommen.php?lang=DE page title on backend/pages/modify.php. The CVSS metrics indicate a Low (CVSS2: 3.5) to Medium (CVSS3: 5.4) base severity, with network attack vector, low complexity, and user interaction ...