45651 matches found
Arbitrary File Upload
Overview cadmium-org/cadmium-cms is a Сontent management system for PHP7 Affected versions of this package are vulnerable to Arbitrary File Upload via the admin/content/filemanager/uploads endpoint. An attacker can execute arbitrary code or upload malicious files by submitting crafted files to th...
EUVD-2025-204847
Cadmium CMS has a background arbitrary file upload vulnerability...
Cadmium CMS has a background arbitrary file upload vulnerability
Cadmium CMS v.0.4.9 has a background arbitrary file upload vulnerability in /admin/content/filemanager/uploads...
CVE-2025-51511
Cadmium CMS v.0.4.9 has a background arbitrary file upload vulnerability in /admin/content/filemanager/uploads...
CVE-2025-67291
A stored cross-site scripting XSS vulnerability in the Media module of Piranha CMS v12.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name field...
CVE-2025-67290
A stored cross-site scripting XSS vulnerability in the Page Settings module of Piranha CMS v12.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Excerpt field...
Malicious code in ddxq_cms_tools (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1c79b5bf164abe664b45e8c5ffcc1a0b7b68214b8b37182338b4c34ca4ae4b3a The package ddxqcmstools was found to contain malicious code...
EUVD-2025-204921
Malicious code in ddxqcmstools npm...
EUVD-2025-204927
Malicious code in cmscomppopup npm...
CVE-2025-15005
A security flaw has been discovered in CouchCMS up to 2.4. Affected is an unknown function of the file couch/config.example.php of the component reCAPTCHA Handler. The manipulation of the argument KRECAPTCHASITEKEY/KRECAPTCHASECRETKEY results in use of hard-coded cryptographic key . It is possibl...
EUVD-2023-60237
Atom CMS 2.0 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries through unvalidated parameters. Attackers can inject malicious SQL code in the 'id' parameter of the admin index page to execute time-based blind SQL injection attacks...
CVE-2025-67443
Schlix CMS before v2.2.9-5 is vulnerable to Cross Site Scripting XSS. Due to lack of javascript sanitization in the login form, incorrect login attempts in logs are triggered as XSS in the admin panel...
CVE-2025-67288
An arbitrary file upload vulnerability in Umbraco CMS v16.3.3 allows attackers to execute arbitrary code by uploading a crafted PDF file. NOTE: this is disputed by the Supplier because the responsibility for file validation as shown in the documentation belongs to the system administrator who is...
CVE-2025-51511
Cadmium CMS v0.4.9 is affected by a background arbitrary file upload vulnerability at /admin/content/filemanager/uploads. The issue allows an attacker to upload crafted files via that endpoint, with potential to upload malicious files and even execute arbitrary code according to Snyk’s descriptio...
PT-2025-52837
Name of the Vulnerable Software and Affected Versions CSZ CMS version 1.2.7 Description An HTML injection issue exists in CSZ CMS that permits authenticated users to inject malicious hyperlinks into message titles. Attackers can create POST requests to the member messaging system using HTML-based...
CSZ CMS 跨站脚本漏洞
CSZ CMS is an open source web application by the individual developer Cskaza Bassist that allows managing all content and settings on a website. A cross-site scripting vulnerability exists in CSZ CMS version 1.2.7, which stems from insufficient validation of user-agent header inputs and could lea...
CSZ CMS 跨站脚本漏洞
CSZ CMS is an open source web application by the individual developer Cskaza Bassist that allows managing all content and settings on a website. A cross-site scripting vulnerability exists in CSZ CMS version 1.2.7, which stems from insufficient validation of message header inputs and could lead t...
CVE-2025-51511
Cadmium CMS v.0.4.9 has a background arbitrary file upload vulnerability in /admin/content/filemanager/uploads...
CVE-2023-53975
Atom CMS 2.0 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries through unvalidated parameters. Attackers can inject malicious SQL code in the 'id' parameter of the admin index page to execute time-based blind SQL injection attacks...