588 matches found
DSCMS Cross-Site Request Forgery Vulnerability
DESHANG DSCMS is a set of PHP and MySQL based CMS enterprise website building system of China Deshang DESHANG Network Technology Company. A cross-site request forgery vulnerability exists in DESHANG DSCMS version 1.1. A remote attacker can exploit this vulnerability to perform unauthorized...
PortfolioCMS Cross-Site Request Forgery Vulnerability
portfolioCMS is a content management system CMS based on PHP and MySQL. A cross-site request forgery vulnerability exists in portfolioCMS version 1.0.5. A remote attacker can exploit this vulnerability to create a new page with admin/portfolio.php?newpage=true...
XSS Vulnerability in Hot Drama CMS v2.1
Hot Drama CMS is a movie and TV station building system developed by PHP+MySQL. A stored xss injection vulnerability exists in /wap/book.php in Hot Drama CMS v2.1, which can be exploited by attackers to obtain an administrator cookie...
CVE-2018-13445
An issue was discovered in SeaCMS 6.61. There is a CSRF vulnerability that can add a user account via adm1n/adminmanager.php?action=add...
HongCMS Arbitrary Script File Upload Vulnerability
HongCMS is an open source lightweight content management system CMS. HongCMS 3.0.0 suffers from an arbitrary script file upload vulnerability. An attacker can exploit this vulnerability by uploading arbitrary script files via admin/index.php/template/upload URI to execute PHP code...
CVE-2018-11556
tificc in Little CMS 2.9 has an out-of-bounds write in the cmsPipelineCheckAndRetreiveStages function in cmslut.c in liblcms2.a via a crafted TIFF file. NOTE: Little CMS developers do consider this a vulnerability because the issue is based on an sample program using LIBTIFF and do not apply to t...
Design/Logic Flaw
Frog CMS 0.9.5 has XSS via the admin/?/page/edit pagekeywords parameter, aka Edit Page Metadata...
Design/Logic Flaw
joyplus-cms 1.6.0 has XSS in manager/adminvod.php via the keyword parameter...
CVE-2018-9926
An issue was discovered in WUZHI CMS 4.1.0. There is a CSRF vulnerability that can add an admin account via index.php?m=core&f=power&v=add...
idreamsoft iCMS SQL Injection Vulnerability
idreamsoft iCMS is an open source content management system CMS based on PHP and MySQL. A SQL injection vulnerability exists in idreamsoft iCMS 7.0.7 and earlier versions. A remote attacker can exploit this vulnerability to execute arbitrary SQL commands with the 'pid' array parameter in the...
SQL Injection Vulnerability in cms js/comments.php File
Search once cms video program is a set of ASP + MSSQL/ACCESS PHP + MYSQL environment to build an intelligent station-building system. Search once cms v1.6 php version of the js/comments.php file there is a sql injection vulnerability, an attacker can use the vulnerability to obtain database...
SQL Injection Vulnerability in iZhanCMS v2.1 GoodsController.php Page
Station CMS is an open source and free CMS content management system. iZhanCMS v2.1 SQL injection vulnerability exists in the GoodsController.php page, which can be exploited by attackers to obtain sensitive information from the database...
Arbitrary Code Write Vulnerability in SeaCMS admin/admin_weixin.php File
SeaCMS is a free and open source web content management system written in PHP. The system has been designed primarily to manage video-on-demand resources. An arbitrary code write vulnerability exists in the admin/adminweixin.php file in SeaCMS version v6.5.8, which can be exploited by an attacker...
CVE-2017-16941
October CMS through 1.0.428 does not prevent use of .htaccess in themes, which allows remote authenticated users to execute arbitrary PHP code by downloading a theme ZIP archive from /backend/cms/themes, and then uploading and importing a modified archive with two new files: a .php file and a...
Cross-site Scripting (XSS)
October CMS is vulnerable to cross-site scripting XSS attacks. The library does not properly sanitize the brand logo image name, allowing a malicious user to inject and execute arbitrary Javascript...
CVE-2017-1000193
October CMS build 412 is vulnerable to stored WCI a.k.a XSS in brand logo image name resulting in JavaScript code execution in the victim's browser...
CVE-2017-1000193
October CMS build 412 is vulnerable to stored WCI a.k.a XSS in brand logo image name resulting in JavaScript code execution in the victim's browser...
CVE-2017-1000119
October CMS build 412 is vulnerable to PHP code execution in the file upload functionality resulting in site compromise and possibly other applications on the server...