PT-2025-31055 · 299Ko Cms · 299Ko Cms

Name of the Vulnerable Software and Affected Versions: 299Ko CMS version 2.0.0 Description: A critical vulnerability exists in the File Management component of 299Ko CMS 2.0.0. The issue involves unrestricted file upload through manipulation of the /admin/filemanager/view file. The attack can be...

PT-2025-30941 · Hax Cms +1 · Hax Cms +2

Name of the Vulnerable Software and Affected Versions: HAX CMS versions 11.0.8 and below haxcms-php HAX CMS versions 11.0.13 and below haxcms-nodejs Description: The HAX CMS API endpoints do not perform authorization checks when interacting with resources. Both the JavaScript and PHP versions of...

CVE-2025-54137

HAX CMS NodeJS allows users to manage their microsite universe with a NodeJS backend. Versions 11.0.9 and below were distributed with hardcoded default credentials for the user and superuser accounts. Additionally, the application has default private keys for JWTs. Users aren't prompted to change...

CVE-2025-46099

In Pluck CMS 4.7.20-dev, an authenticated attacker can upload or create a crafted PHP file under the albums module directory and access it via the module routing logic in albums.site.php, resulting in arbitrary command execution through a GET parameter...

PT-2025-30602 · Unknown · Mezzanine Cms

Name of the Vulnerable Software and Affected Versions: Mezzanine CMS version 6.1.0 Description: A cross-site scripting XSS vulnerability exists in the /blog/blogpost/add component of Mezzanine CMS. This allows attackers to execute arbitrary web scripts or HTML by injecting a crafted payload into ...

The vulnerability of the Response Header Handler component in the Craft CMS system allows a hacker to execute arbitrary code.

The vulnerability of the Response Header Handler component in the Craft CMS content management system is related to errors in HTTP request processing. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

PT-2025-27826 · Bolt Cms · Bolt Cms

Name of the Vulnerable Software and Affected Versions: Bolt CMS versions 3.7.0 and earlier Description: The issue allows an authenticated user to achieve remote code execution. This is done by injecting arbitrary PHP code into the displayname field of the user profile, which is rendered unsanitiz...

CVE-2025-6736 juzaweb CMS Add New Themes Page install improper authorization

A vulnerability classified as critical was found in juzaweb CMS 3.4.2. Affected by this vulnerability is an unknown functionality of the file /admin-cp/theme/install of the component Add New Themes Page. The manipulation leads to improper authorization. The attack can be launched remotely. The...

CVE-2025-6735

JuzaWeb CMS 3.4.2 contains a vulnerability in the Import Page component (unknown function under /admin-cp/imports) that allows improper authorization. The issue can be exploited remotely and public PoC/exploit details exist. Vendor did not respond to disclosure. Reported data indicate various CVS...

CVE-2025-6735 juzaweb CMS Import Page imports improper authorization

A vulnerability classified as critical has been found in juzaweb CMS 3.4.2. Affected is an unknown function of the file /admin-cp/imports of the component Import Page. The manipulation leads to improper authorization. It is possible to launch the attack remotely. The exploit has been disclosed to...

Adobe Experience Manager 跨站脚本漏洞

Adobe Experience Manager is a set of content management solutions that can be used to build websites, mobile applications and forms from the American company Audobee Adobe. The program supports mobile content management, marketing and sales campaign management and multi-site management. A...

CVE-2025-5423

A vulnerability has been found in juzaweb CMS up to 3.4.2 and classified as critical. This vulnerability affects unknown code of the file /admin-cp/setting/system/general of the component General Setting Page. The manipulation leads to improper access controls. The attack can be initiated remotel...

CVE-2025-48996

CVE-2025-48996 describes an unauthenticated information disclosure in HAX open-apis used by PSU deployment of HAX CMS via the haxPsuUsage API endpoint. The vulnerability allows remote, unauthenticated users to enumerate a full list of PSU websites hosted on HAX CMS. The issue is associated with o...

CVE-2025-5434

CVE-2025-5434 refers to a SQL injection in Aem Solutions CMS (versions up to 1.0) arising from unsafely handling the ID parameter in /page.php. Multiple sources (NVD, Red Hat, CVE/CVEList, PT-Security, CNNVD) describe remote exploitation and disclosure of the exploit; affected component is the /p...

CVE-2025-5425 juzaweb CMS Theme Editor Page default access control

A vulnerability was found in juzaweb CMS up to 3.4.2. It has been classified as critical. Affected is an unknown function of the file /admin-cp/theme/editor/default of the component Theme Editor Page. The manipulation leads to improper access controls. It is possible to launch the attack remotely...

CVE-2025-5423

A vulnerability has been found in juzaweb CMS up to 3.4.2 and classified as critical. This vulnerability affects unknown code of the file /admin-cp/setting/system/general of the component General Setting Page. The manipulation leads to improper access controls. The attack can be initiated remotel...

PT-2025-23479 · Marwal Infotech · Marwal Infotech Cms

Name of the Vulnerable Software and Affected Versions: Marwal Infotech CMS version 1.0 Description: A critical vulnerability was found in Marwal Infotech CMS, affecting unknown code of the file /page.php. The manipulation of the ID argument leads to SQL injection. The attack can be initiated...

PT-2025-23555 · Hax · Hax Cms +1

Name of the Vulnerable Software and Affected Versions: HAX open-apis versions up to and including 10.0.2 Description: An unauthenticated information disclosure issue exists in the HAX content management system via the haxPsuUsage API endpoint. This allows any remote unauthenticated user to retrie...

Craft CMS External Control of Assumed-Immutable Web Parameter Vulnerability

Craft CMS contains an external control of assumed-immutable web parameter vulnerability. This vulnerability could allow an unauthenticated client to introduce arbitrary values, such as PHP code, to a known local file location on the server. This vulnerability could be chained with CVE-2024-58136 ...

CVE-2025-5383 Yifang CMS Article Management Module cross site scripting

A vulnerability was found in Yifang CMS up to 2.0.2 and classified as problematic. Affected by this issue is some unknown functionality of the component Article Management Module. The manipulation of the argument Default Value leads to cross site scripting. The attack may be launched remotely. Th...