PT-2025-46721

Name of the Vulnerable Software and Affected Versions pH7Software pH7-Social-Dating-CMS version 17.9.1 Description A stored cross-site scripting XSS issue exists in the application's message system. Unsanitized message content submitted by a user is stored by the server and displayed to other use...

pH7 Social Dating Builder 安全漏洞

pH7 Social Dating Builder is an open source social dating system from pH7 Social Dating CMS pH7CMS. A security vulnerability exists in pH7 Social Dating Builder version 17.9.1, which stems from the messaging system not cleaning up user submissions and could lead to a stored cross-site scripting...

FoxCMS Cross-Site Scripting Vulnerability

FoxCMS is a free commercial open source content management system from China Qianxu FoxCMS. FoxCMS 1.2.16 and previous versions of the existence of cross-site scripting vulnerability, the vulnerability stems from the file app/admin/controller/Product.php parameter Title on the user-provided data...

CVE-2025-63645

CVE-2025-63645 is a stored XSS in pH7Software pH7-Social-Dating-CMS 17.9.1, affecting the messaging system where unsanitized message content is persisted and later rendered in Inbox view without proper encoding, allowing attacker-controlled content to execute in a recipient’s browser. Public docs...

EUVD-2025-50830

An authenticated arbitrary file upload vulnerability in the /uploads/ endpoint of CMS Made Simple Foundation File Manager v2.2.22 allows attackers with Administrator privileges to execute arbitrary code via uploading a crafted PHP file...

CVE-2025-63678

An authenticated arbitrary file upload vulnerability in the /uploads/ endpoint of CMS Made Simple Foundation File Manager v2.2.22 allows attackers with Administrator privileges to execute arbitrary code via uploading a crafted PHP file...

CVE-2025-63678

An authenticated arbitrary file upload vulnerability in the /uploads/ endpoint of CMS Made Simple Foundation File Manager v2.2.22 allows attackers with Administrator privileges to execute arbitrary code via uploading a crafted PHP file...

CVE-2025-60574

A Local File Inclusion LFI vulnerability has been identified in tQuadra CMS 4.2.1117. The issue exists in the "/styles/" path, which fails to properly sanitize user-supplied input. An attacker can exploit this by sending a crafted GET request to retrieve arbitrary files from the underlying system...

Grav CMS Cross-Site Scripting Vulnerability

Grav CMS is a modern, lightweight content management system CMS with a file-driven architecture that runs without relying on traditional databases. Grav CMS suffers from a cross-site scripting vulnerability that stems from the application's lack of effective filtering and escaping of user-supplie...

CVE-2025-63678

An authenticated arbitrary file upload vulnerability in the /uploads/ endpoint of CMS Made Simple Foundation File Manager v2.2.22 allows attackers with Administrator privileges to execute arbitrary code via uploading a crafted PHP file...

PT-2025-46221

Name of the Vulnerable Software and Affected Versions CMS Made Simple Foundation File Manager version 2.2.22 Description An authenticated arbitrary file upload issue exists in the /uploads/ endpoint of the software. An attacker with Administrator privileges can upload a crafted PHP file,...

CVE-2025-63678

Summary: CVE-2025-63678 affects CMS Made Simple Foundation File Manager v2.2.22. An authenticated attacker with Administrator privileges can upload a crafted PHP file to the /uploads/ endpoint, potentially leading to arbitrary code execution. This aligns with multiple sources in the connected doc...

CVE-2025-63678

An authenticated arbitrary file upload vulnerability in the /uploads/ endpoint of CMS Made Simple Foundation File Manager v2.2.22 allows attackers with Administrator privileges to execute arbitrary code via uploading a crafted PHP file...

CMSmadesimple 安全漏洞

CMSmadesimple is an open source content management system from the CMS Made Simple Foundation. A security vulnerability exists in CMSmadesimple version 2.2.22, which originates from the presence of an authenticated, arbitrary file upload in the /uploads/ endpoint and could lead to the execution o...

CVE-2025-60574

A Local File Inclusion LFI vulnerability has been identified in tQuadra CMS 4.2.1117. The issue exists in the "/styles/" path, which fails to properly sanitize user-supplied input. An attacker can exploit this by sending a crafted GET request to retrieve arbitrary files from the underlying system...

CVE-2025-63551

A Server-Side Request Forgery SSRF vulnerability, achievable through an XML External Entity XXE injection, exists in MetInfo Content Management System CMS thru 8.1. This flaw stems from a defect in the XML parsing logic, which allows an attacker to construct a malicious XML entity that forces the...

PT-2025-45508

Name of the Vulnerable Software and Affected Versions tQuadra CMS version 4.2.1117 Description A Local File Inclusion LFI issue exists in tQuadra CMS. The vulnerability is located in the "/styles/" path, which does not properly sanitize user-supplied input. An attacker can exploit this by sending...

CVE-2025-60574

A Local File Inclusion LFI vulnerability has been identified in tQuadra CMS 4.2.1117. The issue exists in the "/styles/" path, which fails to properly sanitize user-supplied input. An attacker can exploit this by sending a crafted GET request to retrieve arbitrary files from the underlying system...

CVE-2025-60574

CVE-2025-60574 affects tQuadra CMS 4.2.1117. The vulnerability is a Local File Inclusion (LFI) in the "/styles/" path caused by insufficient sanitization of user input, enabling an attacker to retrieve arbitrary files from the underlying system via a crafted GET request. Connected sources consist...

tQuadra CMS 安全漏洞

tQuadra CMS is a content management system from the Italian company tQuadra CMS. A security vulnerability exists in tQuadra CMS version 4.2.1117, which stems from the /styles path not being properly cleaned of user input, which could lead to a local file inclusion attack...