CMONOS.JP vulnerable to cross-site scripting

Overview CMONOS.JP provided CMONOS Co. Ltd. is a content management system CMS. CMONOS.JP contains a stored cross-site scripting vulnerability CWE-79. stypr of Flatt Security Inc. reported this vulnerability to the developer and coordinated on his own. After coordination was completed, this case...

CVE-2020-19881

DBHcms v1.2.0 has a reflected xss vulnerability as there is no security filter in dbhcms\mod\mod.selector.php line 108 for $GET'returnname' parameter, A remote authenticated with admin user can exploit this vulnerability to hijack other users...

Code Execution Vulnerability in CAYIN Technology CMS

CAYIN Technology CMS is a content management system CMS from CAYIN Technology in Taiwan, China. A security vulnerability exists in the 'ntpIp' parameter of the systemservice.cgi file in CAYIN Technology CMS version 11.0 and earlier. A remote attacker could exploit the vulnerability to execute cod...

SQL Injection Vulnerability in PHPCMS of Coolmouse (Beijing) Culture Media Co.

PHPCMS is a self-developed framework using the OOP object-oriented approach. There is a SQL injection vulnerability in PHPCMS of CoolSkate Beijing Culture Media Co. Ltd, which can be exploited by attackers to obtain sensitive information from the database...

PHPCMS version 9.1.5 to 9.6.3 SQL injection vulnerability in content module si***.php page

PHPCMS uses PHP5+MYSQL as the technical basis for development.V9 uses OOP object-oriented approach to build the basic operational framework. PHPCMS 9.1.5 to 9.6.3 versions of the content module si.php page there is a SQL injection vulnerability, attackers can use the vulnerability to obtain...

Command execution vulnerability in PbootCMS Pa***.php file

PbootCMS is an open source and free PHP enterprise web development and construction management system. PbootCMS Pa.php file has a command execution vulnerability. An attacker can exploit this vulnerability to execute arbitrary php code and gain server privileges...

File inclusion vulnerability in 115CMS backend In***.php file

115CMS is a content management system developed on ThinkPHP framework. A file inclusion vulnerability exists in the 115CMS backend In.php file. An attacker can exploit this vulnerability to upload arbitrary files and gain control of the web server...

MyuCMS open source content management system suffers from SQL injection vulnerability

MyuCMS open source content management system developed using ThinkPHP community mall aggregation, plug-ins, templates, lightweight and fast easy to expand. MyuCMS open source content management system has a SQL injection vulnerability , attackers can exploit the vulnerability to obtain sensitive...

FUEL CMS Cross-Site Request Forgery Vulnerability (CNVD-2021-18031)

FUEL CMS is a content management system CMS based on the Codelgniter framework. A cross-site request forgery vulnerability exists in the blocks/create/Create Blocks section of the Admin console in FUEL CMS version 1.4.4. The vulnerability stems from the WEB application not adequately verifying th...

Unspecified vulnerability in ZZCMS user/manage.php file

ZZCMS is a content management system CMS by the ZZCMS team in China. A security vulnerability exists in the user/manage.php file in ZZCMS 8.3 and earlier versions. An attacker can exploit the vulnerability to execute code...

SQL Injection Vulnerability in the out-of-box cms cp***.asp File

Out of the ordinary cms website building system is usually used by industrial, communication, manufacturing and technology companies as a website building system, which is very widely used. SQL injection vulnerability exists in the cp.asp file, which can be exploited by attackers to obtain databa...

SemCMS foreign trade website php version V3.8 suffers from SQL injection vulnerability

SemCms is a set of open source foreign trade enterprise website management system, mainly used for foreign trade enterprises, compatible with IE, Firefox, google, 360 and other mainstream browsers. SemCMS foreign trade website php version V3.8 version of the existence of SQL injection...

Arbitrary File Deletion Vulnerability in Acme CMS

Acme CMS is a full-featured, PHP + Mysql architecture, multi-language, responsive display, suitable for personal website construction CMS building system. Acme CMS has an arbitrary file deletion vulnerability, attackers can construct packets sent to the server, so as to delete arbitrary files,...

Harmis JE Messenger Component SQL Injection Vulnerability in Joomla!

Joomla! is an open source, cross-platform content management system CMS developed by the Open Source Matters team in the United States using PHP and MySQL. Harmis JE Messenger component is used in one of the personal messaging components, which supports incoming and outgoing e-mail and online...

CVE-2018-20680

Frog CMS 0.9.5 has XSS in the admin/?/page/edit/1 body field...

CVE-2018-19902

No-CMS 1.1.3 is prone to Persistent XSS via the blog/managearticle "keyword" parameter...

Sql injection

FROG CMS 0.9.5 has XSS via the admin/?/snippet/add name parameter, which is mishandled during an edit action, a related issue to CVE-2018-10319...

CVE-2018-20478

An issue was discovered in S-CMS 1.0. It allows reading certain files, such as PHP source code, via the admin/download.php DownName parameter with a mixed-case extension, as demonstrated by a DownName=download.Php value...

S-CMS SQL Injection Vulnerability (CNVD-2019-08326)

S-CMS is Zibo Shining Network Technology Co., Ltd. developed a specialized enterprise to provide solutions to build a station of the product. S-CMS 3.0 has a SQL injection vulnerability, which can be exploited by attackers through the Sid parameter to conduct SQL injection attacks...

S-CMS Cross-Site Request Forgery Vulnerability

S-CMS is Zibo Shining Network Technology Co., Ltd. developed a specialized enterprise to provide solutions to build a station of the product. S-CMS 1.5 there is a cross-site request forgery vulnerability, attackers can add new users through admin/ajax.php?type=member&action=add URI to take...