CVE-2018-16732

CVE-2018-16732 affects CScms 4.1. The flaw is in \upload\plugins\sys\admin\Setting.php, enabling CSRF via admin.php/setting/ftp_save. CVSS data: v2 base 6.8 (NETWORK, no auth, partial CIA/I/A), and CVSSv3 base 8.8 (NETWORK, UI REQUIRED, HIGH impact on Confidentiality, Integrity, Availability). Co...

CVE-2018-16730

\upload\plugins\sys\Install.php in CScms 4.1 has XSS via the site name...

PT-2018-13709

Name of the Vulnerable Software and Affected Versions CScms version 4.1 Description The issue allows for arbitrary file upload. This can be achieved by modifying the default filetype list, which includes gif, jpg, and png, to accept other file types, such as php. An attacker can then specify a .p...

PT-2018-13708

Name of the Vulnerable Software and Affected Versions CScms version 4.1 Description The issue concerns an XSS vulnerability in the uploadpluginssysInstall.php file of CScms. This vulnerability can be exploited via the site name. Recommendations For CScms version 4.1, update the Install.php file t...

CVE-2018-16731: Unrestricted Upload of File with Dangerous Type

CScms 4.1 allows arbitrary file upload by for example adding the php extension to the default filetype list gif, jpg, png, and then providing a .php pathname within fileurl JSON data...

PT-2018-13710

Name of the Vulnerable Software and Affected Versions CScms version 4.1 Description The issue concerns a CSRF vulnerability in the Setting.php file within the CScms software. This vulnerability can be exploited via the "admin.php/setting/ftp save" endpoint. Recommendations For CScms version 4.1,...

CVE-2018-16730: Improper Neutralization of Input During Web Page Generation

\upload\plugins\sys\Install.php in CScms 4.1 has XSS via the site name...

CVE-2018-16732: Cross-Site Request Forgery (CSRF)

\upload\plugins\sys\admin\Setting.php in CScms 4.1 allows CSRF via admin.php/setting/ftpsave...

CVE-2018-16448

Cscms 4 allows CSRF for creating a member via upload/admin.php/user/save, authenticating vip members via upload/admin.php/user/init/tid and upload/admin.php/user/init/rzid, and creating a super administrator and web editor via upload/admin.php/sys/save...

CVE-2018-16448

Cscms 4 allows CSRF for creating a member via upload/admin.php/user/save, authenticating vip members via upload/admin.php/user/init/tid and upload/admin.php/user/init/rzid, and creating a super administrator and web editor via upload/admin.php/sys/save...

Cross site request forgery (csrf)

Cscms 4 allows CSRF for creating a member via upload/admin.php/user/save, authenticating vip members via upload/admin.php/user/init/tid and upload/admin.php/user/init/rzid, and creating a super administrator and web editor via upload/admin.php/sys/save...

CVE-2018-16448

Cscms 4 allows CSRF for creating a member via upload/admin.php/user/save, authenticating vip members via upload/admin.php/user/init/tid and upload/admin.php/user/init/rzid, and creating a super administrator and web editor via upload/admin.php/sys/save...

CVE-2018-16448

CVE-2018-16448 affects Cscms 4. It documents CSRF in admin endpoints: creating a member via upload/admin.php/user/save; authenticating vip members via upload/admin.php/user/init/tid and upload/admin.php/user/init/rzid; and creating a super administrator and web editor via upload/admin.php/sys/sav...

CScms Cross-Site Request Forgery Vulnerability (CNVD-2018-19079)

CScms is a content management system CMS developed on a CI framework. A cross-site request forgery vulnerability exists in Cscms version 4.1.8, which can be exploited by remote attackers to modify the basic configuration of a website with the help of upload/admin.php/setting/save...

PT-2018-13575

Name of the Vulnerable Software and Affected Versions Cscms version 4 Description The issue allows for CSRF attacks, enabling unauthorized actions such as creating a member, authenticating vip members, creating a super administrator, and creating a web editor through specific API endpoints:...

CVE-2018-16448: Cross-Site Request Forgery (CSRF)

Cscms 4 allows CSRF for creating a member via upload/admin.php/user/save, authenticating vip members via upload/admin.php/user/init/tid and upload/admin.php/user/init/rzid, and creating a super administrator and web editor via upload/admin.php/sys/save...

CVE-2018-16337

An issue was discovered in Cscms V4.1.8. There is a CSRF vulnerability that can modify a website's basic configuration via upload/admin.php/setting/save...

CVE-2018-16337

An issue was discovered in Cscms V4.1.8. There is a CSRF vulnerability that can modify a website's basic configuration via upload/admin.php/setting/save...

Cross site request forgery (csrf)

An issue was discovered in Cscms V4.1.8. There is a CSRF vulnerability that can modify a website's basic configuration via upload/admin.php/setting/save...

CVE-2018-16337

CVE-2018-16337 affects Cscms v4.1.8. A CSRF flaw allows modification of a website's basic configuration via upload/admin.php/setting/save. The connected CNVD/NVD entries confirm the Cross-Site Request Forgery impact on Cscms 4.1.8. No remediation details are provided in the supplied documents.