CVE-2018-16731

CVE-2018-16731 affects CScms 4.1 and is described as an arbitrary file upload vulnerability: an attacker can add the php extension to the allowed filetype list and supply a .php pathname inside the fileurl JSON data to obtain uploaded PHP code. The connected records confirm the issue and provide ...

CVE-2018-16730

\upload\plugins\sys\Install.php in CScms 4.1 has XSS via the site name...

PT-2018-13708

Name of the Vulnerable Software and Affected Versions CScms version 4.1 Description The issue concerns an XSS vulnerability in the uploadpluginssysInstall.php file of CScms. This vulnerability can be exploited via the site name. Recommendations For CScms version 4.1, update the Install.php file t...

PT-2018-13710

Name of the Vulnerable Software and Affected Versions CScms version 4.1 Description The issue concerns a CSRF vulnerability in the Setting.php file within the CScms software. This vulnerability can be exploited via the "admin.php/setting/ftp save" endpoint. Recommendations For CScms version 4.1,...

CVE-2018-16732: Cross-Site Request Forgery (CSRF)

\upload\plugins\sys\admin\Setting.php in CScms 4.1 allows CSRF via admin.php/setting/ftpsave...

PT-2018-13709

Name of the Vulnerable Software and Affected Versions CScms version 4.1 Description The issue allows for arbitrary file upload. This can be achieved by modifying the default filetype list, which includes gif, jpg, and png, to accept other file types, such as php. An attacker can then specify a .p...

CVE-2018-16731: Unrestricted Upload of File with Dangerous Type

CScms 4.1 allows arbitrary file upload by for example adding the php extension to the default filetype list gif, jpg, png, and then providing a .php pathname within fileurl JSON data...

CVE-2018-16730: Improper Neutralization of Input During Web Page Generation

\upload\plugins\sys\Install.php in CScms 4.1 has XSS via the site name...

CVE-2018-16448

Cscms 4 allows CSRF for creating a member via upload/admin.php/user/save, authenticating vip members via upload/admin.php/user/init/tid and upload/admin.php/user/init/rzid, and creating a super administrator and web editor via upload/admin.php/sys/save...

Cross site request forgery (csrf)

Cscms 4 allows CSRF for creating a member via upload/admin.php/user/save, authenticating vip members via upload/admin.php/user/init/tid and upload/admin.php/user/init/rzid, and creating a super administrator and web editor via upload/admin.php/sys/save...

CVE-2018-16448

Cscms 4 allows CSRF for creating a member via upload/admin.php/user/save, authenticating vip members via upload/admin.php/user/init/tid and upload/admin.php/user/init/rzid, and creating a super administrator and web editor via upload/admin.php/sys/save...

CVE-2018-16448

CVE-2018-16448 affects Cscms 4. It documents CSRF in admin endpoints: creating a member via upload/admin.php/user/save; authenticating vip members via upload/admin.php/user/init/tid and upload/admin.php/user/init/rzid; and creating a super administrator and web editor via upload/admin.php/sys/sav...

CVE-2018-16448

Cscms 4 allows CSRF for creating a member via upload/admin.php/user/save, authenticating vip members via upload/admin.php/user/init/tid and upload/admin.php/user/init/rzid, and creating a super administrator and web editor via upload/admin.php/sys/save...

PT-2018-13575

Name of the Vulnerable Software and Affected Versions Cscms version 4 Description The issue allows for CSRF attacks, enabling unauthorized actions such as creating a member, authenticating vip members, creating a super administrator, and creating a web editor through specific API endpoints:...

CVE-2018-16448: Cross-Site Request Forgery (CSRF)

Cscms 4 allows CSRF for creating a member via upload/admin.php/user/save, authenticating vip members via upload/admin.php/user/init/tid and upload/admin.php/user/init/rzid, and creating a super administrator and web editor via upload/admin.php/sys/save...

CScms Cross-Site Request Forgery Vulnerability (CNVD-2018-19079)

CScms is a content management system CMS developed on a CI framework. A cross-site request forgery vulnerability exists in Cscms version 4.1.8, which can be exploited by remote attackers to modify the basic configuration of a website with the help of upload/admin.php/setting/save...

Cross site request forgery (csrf)

An issue was discovered in Cscms V4.1.8. There is a CSRF vulnerability that can modify a website's basic configuration via upload/admin.php/setting/save...

CVE-2018-16337

An issue was discovered in Cscms V4.1.8. There is a CSRF vulnerability that can modify a website's basic configuration via upload/admin.php/setting/save...

CVE-2018-16337

An issue was discovered in Cscms V4.1.8. There is a CSRF vulnerability that can modify a website's basic configuration via upload/admin.php/setting/save...

CVE-2018-16337

CVE-2018-16337 affects Cscms v4.1.8. A CSRF flaw allows modification of a website's basic configuration via upload/admin.php/setting/save. The connected CNVD/NVD entries confirm the Cross-Site Request Forgery impact on Cscms 4.1.8. No remediation details are provided in the supplied documents.