CVE-2024-30614

CVE-2024-30614 affects Ametys CMS v4.5.0 and earlier. The issue allows attackers to obtain sensitive information by exposing resources to the error scope, indicating a faulty error handling/resource exposure in the CMS. Red Hat and CNNVD corroborate the same description; PT Security recommends up...

CVE-2024-30614

An issue in Ametys CMS v4.5.0 and before allows attackers to obtain sensitive information via exposed resources to the error scope...

CVE-2024-2753

Concrete CMS version 9 before 9.2.8 and previous versions prior to 8.5.16 is vulnerable to Stored XSS on the calendar color settings screen since Information input by the user is output without escaping. A rogue administrator could inject malicious javascript into the Calendar Color Settings scre...

CVE-2024-3180

Concrete CMS CVE-2024-3180 describes a Stored XSS in blocks of type file. A rogue administrator can inject malicious code into the link-text field when creating a file block, affecting Concrete CMS versions 9.0.0–9.2.7 and 8.5.15 and earlier. Root cause is insufficient input sanitization in the f...

CVE-2024-3146

A vulnerability classified as problematic has been found in DedeCMS 5.7. This affects an unknown part of the file /src/dede/makehtmlrssaction.php. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and...

SOY CMS Security Vulnerability

SOY CMS is a content management system CMS. A security vulnerability exists in SOY CMS versions prior to 3.14.2 that originates from allowing arbitrary operating system commands to be executed via specially crafted filenames containing semicolons, which can affect jpegoptim functionality...

Concrete CMS Security Vulnerability

PortlandLabs Concrete CMS is an open source team-oriented content management system from PortlandLabs, Inc. A security vulnerability exists in Concrete CMS prior to version 9.2.3, which stems from a stored cross-site scripting attack via /dashboard/system/basics/name...

CVE-2024-26445

flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forgery CSRF via the component /core/tools/deleteplace.php...

CVE-2024-25418

flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forgery CSRF via the component /core/tools/deletemenu.php...

CVE-2024-25419

flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forgery CSRF via the component /core/tools/updatemenu.php...

CVE-2024-0728 ForU CMS channel.php file inclusion

A vulnerability classified as problematic was found in ForU CMS up to 2020-06-23. Affected by this vulnerability is an unknown functionality of the file channel.php. The manipulation of the argument ccmodel leads to file inclusion. The attack can be launched remotely. The exploit has been disclos...

CVE-2023-29962

S-CMS v5.0 was discovered to contain an arbitrary file read vulnerability...

CVE-2023-7191 S-CMS reg.php sql injection

A vulnerability, which was classified as critical, was found in S-CMS up to 2.0build20220529-20231006. This affects an unknown part of the file member/reg.php. The manipulation of the argument Mlogin/Memail leads to sql injection. The exploit has been disclosed to the public and may be used. The...

CVE-2023-7189

A vulnerability classified as critical was found in S-CMS up to 2.0build20220529-20231006. Affected by this vulnerability is an unknown functionality of the file /s/index.php?action=statistics. The manipulation of the argument lid leads to sql injection. The exploit has been disclosed to the publ...

CVE-2023-48651

Concrete CMS 9 before 9.2.3 is vulnerable to Cross Site Request Forgery CSRF at /ccm/system/dialogs/file/delete/1/submit...

CVE-2023-51050

S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the Aproductauth parameter at /admin/ajax.php...

Sql injection

S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the Aproductauth parameter at /admin/ajax.php...

S-CMS Security Vulnerabilities

S-CMS is a PHP and MySQL based Content Management System CMS from S-CMS China. A security vulnerability exists in S-CMS v5.0, which originates from the discovery of an SQL injection vulnerability via the Aproductauth parameter in /admin/ajax.php...

CVE-2023-51051

S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the Atextauth parameter at /admin/ajax.php...

Dreamer CMS Security Vulnerability

Dreamer CMS is a Dreamer Content Management System by Junnan Wang, an individual developer in China. A security vulnerability exists in Dreamer CMS versions prior to 4.0.1, which stems from a directory traversal vulnerability. An attacker can exploit this vulnerability to modify template files or...