Monstra CMS Cross-Site Scripting Vulnerability (CNVD-2021-49037)

Monstra is a lightweight content management system CMS. A cross-site scripting vulnerability exists in Monstra version 3.0.4. The vulnerability can be exploited to conduct cross-site scripting attacks via the page function in admin/index.php...

Monstra Remote Code Execution Vulnerability

Monstra is a lightweight content management system CMS. A remote code execution vulnerability exists in Monstra version 3.0.4. The vulnerability can be exploited to execute arbitrary code via the "Snippet content" field under the "Edit Snippet" module...

Webport Path Traversal Vulnerability

WebPort is a remote access and preventive maintenance device. It enables access to control system data and equipment. A path traversal vulnerability exists in Webport CMS in version 1.19.10.17121, which stems from the product failing to properly filter for specific elements in the path of a...

SQL Injection Vulnerability in TPCMS

TPCMS is an open source cms written by thinkphp. TPCMS has a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive database information...

Command Execution Vulnerability in 230CMS

230CMS is a content management system. 230CMS suffers from a command execution vulnerability that can be exploited by an attacker to gain control of the server...

Plone cross-site scripting vulnerability (CNVD-2021-37279)

Plone is a foreign open source CMS system suitable for enterprise-level applications. A cross-site scripting vulnerability exists in the user full name attribute and file upload functionality in Plone CMS versions prior to 5.2.4. The vulnerability stems from user input that is not properly encode...

Pluck Cross-Site Request Forgery Vulnerability

Pluck is a small and simple content management system CMS written in PHP. A cross-site request forgery vulnerability exists in Pluck version 4.7.9. A remote attacker can exploit this vulnerability to execute arbitrary code and delete specific images via the /admin.php?action=images component...

Pluck 跨站请求伪造漏洞

Pluck is a content management system CMS developed using the PHP language. A cross-site request forgery vulnerability exists in Pluck CMS version 4.7.9. A remote attacker can exploit this vulnerability to execute arbitrary code and delete specific articles via the component "/admin.php?action=pag...

PT-2021-14372 · Octobercms +2 · October Cms +1

Impact A bypass of CVE-2020-26231 fixed in 1.0.470/471 and 1.1.1 was discovered that has the same impact as CVE-2020-26231 & CVE-2020-15247: An authenticated backend user with the cms.manage pages, cms.manage layouts, or cms.manage partials permissions who would normally not be permitted to provi...

CVE-2021-29484

Ghost is a Node.js CMS. An unused endpoint added during the development of 4.0.0 has left sites vulnerable to untrusted users gaining access to Ghost Admin. Attackers can gain access by getting logged in users to click a link containing malicious code. Users do not need to enter credentials and m...

File Upload Vulnerability in Super cms v2.39 (CNVD-2021-32174)

Super CMS content management system by the SEO Research Center moonseo.cn in order to solve the problem of website optimization and research and development of a set of products, this product adopts an object-oriented approach to independent research and development of the MVC framework...

Magnolia cross-site scripting vulnerability (CNVD-2021-26171)

Magnolia is a Java-based open source content management system CMS. A stored cross-site scripting vulnerability exists in the setText parameter of /magnoliaAuthor/.magnolia/ in Magnolia versions 6.1.3 - 6.2.3. No details of the vulnerability are provided at this time...

Magnolia Cross-Site Scripting Vulnerability

Magnolia is a Java-based open source content management system CMS. A reflected cross-site scripting vulnerability exists in the /magnoliaPublic/travel/members/login.html mgnlUserId parameter in Magnolia versions 6.1.3 - 6.2.3. No detailed vulnerability details are available at this time...

Cross site request forgery (csrf)

FUEL CMS 1.4.13 contains a cross-site request forgery CSRF vulnerability that can delete a page via a post ID to /pages/delete/3...

Code execution vulnerability in Ocean CMS (CNVD-2021-25369)

Ocean CMS, also known as SEACMS, is completely open source and free of charge, adaptive to computers, cell phones, tablets, APP multi-terminal, no encryption, more secure, it is your best station-building tool! Ocean CMS code execution vulnerabilities, attackers can use the vulnerability to obtai...

Directory Traversal Vulnerability in Five Fingers CMS Backend

Five Fingers CMS is an open source content management system that supports LNAMP architecture. Five Fingers CMS backend has a directory traversal vulnerability that can be exploited by attackers to obtain sensitive information...

Unauthorized access vulnerability in S-CMS enterprise website building system (CNVD-2021-00044)

S-CMS enterprise station building system is Zibo Shining Network Technology Co., Ltd. developed a specialized enterprise station building solutions for the product. There is an unauthorized access vulnerability in S-CMS, which can be exploited by an attacker to gain administrator privileges witho...

Command Execution Vulnerability in Ocean CMS-v10.9 (SeaCMS) ad***_pi***.php File

Ocean CMS, also known as SeaCMS, is developed by php+mysql, completely open source and free of charge, adaptive to computer, cell phone, tablet, APP multi-terminal, no encryption. There is a command execution vulnerability in the file adpi.php in SeaCMS-v10.9 SeaCMS. An attacker can exploit this...

74CMS PHP Remote File Inclusion Vulnerability

Knight CMS 74cms is a free website management system based on PHP+MYSQL, providing perfect talent recruitment website construction program. There is a PHP remote file inclusion vulnerability in the assignresumetpl method in Application/Common/Controller/BaseController.class.php in versions prior ...

Local File Inclusion (LFI)

october/cms is vulnerable to local file inclusion LFI. The vulnerability exists as unauthenticated users can read local files on an October CMS server through a web request...