252 matches found
Cross site scripting
An XSS issue was discovered in Catfish CMS 4.8.30, related to "write source code," a similar issue to CVE-2018-13999...
Catfish CMS Cross-Site Scripting Vulnerability (CNVD-2019-01927)
Catfish CMS is an open source content management system CMS written in PHP. A cross-site scripting vulnerability exists in Catfish CMS version 4.8.30, which can be exploited by remote attackers to inject code...
catfish blog cross-site request forgery vulnerability
Catfish blog is a set of open source blog system developed using the PHP language . A cross-site request forgery vulnerability exists in admin/Index/tiquan in Catfish blog version 2.0.33. A remote attacker can exploit this vulnerability to change the user type...
catfish blog cross-site scripting vulnerability
Catfish blog is a set of open source blog system developed using the PHP language . A cross-site scripting vulnerability exists in Catfish blog version 2.0.33. A remote attacker can exploit this vulnerability to inject code...
Catfish CMS Cross-Site Request Forgery Vulnerability
Catfish CMS is an open source content management system CMS written in PHP. A cross-site request forgery vulnerability exists in the admin/Index/addmanageuser.html page in Catfish CMS version 4.8.30, which can be exploited by remote attackers to add users...
CVE-2018-18735
A CSRF issue was discovered in admin/Index/tiquan in catfish blog 2.0.33...
CVE-2018-18733
CVE-2018-18733 concerns an XSS in Catfish CMS 4.8.30 via the admin/Index/write.html flow (related to “write source code”). Connected sources confirm a similar XSS path in Catfish CMS v4.7.9 using the editorValue parameter of admin/Index/write.html, suggesting a common write.html XSS vector across...
CVE-2018-18736
CVE-2018-18736 corresponds to an XSS vulnerability in catfish blog 2.0.33 (described as related to “write source code”). Affected component: catfish blog (version 2.0.33). Root cause details are not fully specified in the provided documents beyond the XSS note. Potential impact is cross-site scri...
CVE-2018-18735
CVE-2018-18735 describes a cross-site request forgery in Catfish Blog 2.0.33, specifically in the admin/Index/tiquan functionality. The CVE entry notes a CSRF vulnerability that could allow an attacker to affect user roles (e.g., change user type) given the documented access path. From the initia...
CVE-2018-18734
CVE-2018-18734 describes a Cross-Site Request Forgery (CSRF) in Catfish CMS 4.8.30, specifically in the admin/Index/addmanageuser.html page. The issue allows unauthorized actions (adding users) via CSRF. Connected sources confirm the vulnerable component and page in Catfish CMS 4.8.30 and indicat...
CVE-2018-18733
An XSS issue was discovered in Catfish CMS 4.8.30, related to "write source code," a similar issue to CVE-2018-13999...
CVE-2018-18736
An XSS issue was discovered in catfish blog 2.0.33, related to "write source code."...
CVE-2018-18734
A CSRF issue was discovered in admin/Index/addmanageuser.html in Catfish CMS 4.8.30...
Catfish CMS Cross-Site Scripting Vulnerability (CNVD-2018-13273)
Catfish CMS is an open source content management system CMS written in PHP. A cross-site scripting vulnerability exists in Catfish CMS version 4.7.9. A remote attacker can inject arbitrary web script or HTML by sending the 'editorValue' parameter to the admin/Index/write.html page...
CVE-2018-13999
Catfish CMS v4.7.9 allows XSS via the admin/Index/write.html editorValue parameter aka an article posted by an administrator...
Design/Logic Flaw
Catfish CMS v4.7.9 allows XSS via the admin/Index/write.html editorValue parameter aka an article posted by an administrator...
CVE-2018-13999
Catfish CMS v4.7.9 allows XSS via the admin/Index/write.html editorValue parameter aka an article posted by an administrator...
CVE-2018-13999
Catfish CMS v4.7.9 is vulnerable to cross-site scripting via the admin/Index/write.html editorValue parameter (an administrator-posted article). The CVE-2018-13999 entry documents this XSS flaw; related entries note a similar issue in Catfish CMS 4.8.30. The provided documents do not specify a pa...
