99 matches found
ClipperCMS 1.3.3 - Cross-Site Request Forgery (File Upload)
ClipperCMS 1.3.3 - Cross-Site Request Forgery File Upload Exploit Title: ClipperCMS 1.3.3 File Upload CSRF Vulnerability Date: 2018-11-11 Exploit Author: Ameer Pornillos Website: http://ethicalhackers.club Vendor Homepage: http://www.clippercms.com/ Software Link:...
ClipperCMS 1.3.3 - Cross-Site Request Forgery (File Upload)
Exploit Title: ClipperCMS 1.3.3 File Upload CSRF Vulnerability Date: 2018-11-11 Exploit Author: Ameer Pornillos Website: http://ethicalhackers.club Vendor Homepage: http://www.clippercms.com/ Software Link: https://github.com/ClipperCMS/ClipperCMS/releases/tag/clipper1.3.3 Version: 1.3.3 Tested o...
CVE-2018-19135
ClipperCMS 1.3.3 does not have CSRF protection on its kcfinder file upload enabled by default. This can be used by an attacker to perform actions for an admin or any user with the file upload capability. With this vulnerability, one can automatically upload files by default, it allows html, pdf,...
CVE-2018-19135
ClipperCMS 1.3.3 does not have CSRF protection on its kcfinder file upload enabled by default. This can be used by an attacker to perform actions for an admin or any user with the file upload capability. With this vulnerability, one can automatically upload files by default, it allows html, pdf,...
Design/Logic Flaw
ClipperCMS 1.3.3 does not have CSRF protection on its kcfinder file upload enabled by default. This can be used by an attacker to perform actions for an admin or any user with the file upload capability. With this vulnerability, one can automatically upload files by default, it allows html, pdf,...
CVE-2018-19135
ClipperCMS 1.3.3 does not have CSRF protection on its kcfinder file upload enabled by default. This can be used by an attacker to perform actions for an admin or any user with the file upload capability. With this vulnerability, one can automatically upload files by default, it allows html, pdf,...
CVE-2018-19135
Summary of CVE-2018-19135 (ClipperCMS 1.3.3): ClipperCMS 1.3.3 is vulnerable to a Cross-Site Request Forgery (CSRF) in the kcfinder file upload feature, which is enabled by default. The vulnerability allows an attacker to perform actions on behalf of an admin (or any user with file upload capabil...
CVE-2018-19135: Cross-Site Request Forgery (CSRF)
ClipperCMS 1.3.3 does not have CSRF protection on its kcfinder file upload enabled by default. This can be used by an attacker to perform actions for an admin or any user with the file upload capability. With this vulnerability, one can automatically upload files by default, it allows html, pdf,...
PT-2018-14826
Name of the Vulnerable Software and Affected Versions ClipperCMS version 1.3.3 Description The issue concerns the lack of CSRF protection on the kcfinder file upload feature, which is enabled by default. This allows an attacker to perform actions on behalf of an admin or any user with file upload...
ClipperCMS Cross-Site Scripting Vulnerability (CNVD-2018-13274)
ClipperCMS is a content management system CMS. A cross-site scripting vulnerability exists in ClipperCMS version 1.3.3. The vulnerability can be exploited by remote attackers to inject/store malicious scripts and execute them via the Full Name field of the Security - Manager Users or Security - W...
Cross site scripting
ClipperCMS 1.3.3 has stored XSS via the Full Name field of 1 Security - Manager Users or 2 Security - Web Users...
CVE-2018-13998
ClipperCMS 1.3.3 has stored XSS via the Full Name field of 1 Security - Manager Users or 2 Security - Web Users...
CVE-2018-13998
ClipperCMS 1.3.3 has stored XSS via the Full Name field of 1 Security - Manager Users or 2 Security - Web Users...
CVE-2018-13998
ClipperCMS 1.3.3 contains a stored XSS flaw in the Full Name field leveraged from the Security → Manager Users or Security → Web Users interfaces. The root cause is unvalidated/sanitized input stored and later rendered in a context where scripts execute. Impact is user-protection risk through scr...
CVE-2018-13998
ClipperCMS 1.3.3 has stored XSS via the Full Name field of 1 Security - Manager Users or 2 Security - Web Users...
CVE-2018-13998: Improper Neutralization of Input During Web Page Generation
ClipperCMS 1.3.3 has stored XSS via the Full Name field of 1 Security - Manager Users or 2 Security - Web Users...
CVE-2018-13106
ClipperCMS 1.3.3 has stored XSS via the "Tools - Configuration" screen of the manager/ URI...
Cross site scripting
ClipperCMS 1.3.3 has stored XSS via the "Tools - Configuration" screen of the manager/ URI...