CVE-2024-25828: Path Traversal: 'dir/../../filename'

cmseasy V7.7.7.9 has an arbitrary file deletion vulnerability in lib/admin/templateadmin.php...

PT-2024-21145 · Cmseasy · Cmseasy

Name of the Vulnerable Software and Affected Versions: cmseasy version 7.7.7.9 Description: The issue is related to an arbitrary file deletion vulnerability. It affects the lib/admin/template admin.php file. Recommendations: For cmseasy version 7.7.7.9, consider restricting access to the...

cmseasy Security Vulnerabilities

CmsEasy is a content management system CMS for creating responsive websites from China's Kyushu Ecommerce Technology CmsEasy. A security vulnerability exists in cmseasy version V7.7.7.9, which originates from an arbitrary file deletion vulnerability in lib/admin/templateadmin.php...

CVE-2024-25828

cmseasy V7.7.7.9 has an arbitrary file deletion vulnerability in lib/admin/templateadmin.php...

CVE-2024-25828

The cmseasy content management system (CMS), specifically version V7.7.7.9 , is vulnerable to an arbitrary file deletion vulnerability within the lib/admin/template_admin.php file. This security flaw is categorized as a Path Traversal (CWE-27) issue. The impact allows for the unauthorized deletio...

CVE-2024-25828

cmseasy V7.7.7.9 has an arbitrary file deletion vulnerability in lib/admin/templateadmin.php...

CVE-2024-0523

A vulnerability was found in CmsEasy up to 7.7.7. It has been declared as critical. Affected by this vulnerability is the function getslidechildaction in the library lib/admin/languageadmin.php. The manipulation of the argument sid leads to sql injection. The attack can be launched remotely. The...

CVE-2024-0523

A vulnerability was found in CmsEasy up to 7.7.7. It has been declared as critical. Affected by this vulnerability is the function getslidechildaction in the library lib/admin/languageadmin.php. The manipulation of the argument sid leads to sql injection. The attack can be launched remotely. The...

Sql injection

A vulnerability was found in CmsEasy up to 7.7.7. It has been declared as critical. Affected by this vulnerability is the function getslidechildaction in the library lib/admin/languageadmin.php. The manipulation of the argument sid leads to sql injection. The attack can be launched remotely. The...

CVE-2024-0523

CmsEasy CVE-2024-0523 affects versions up to 7.7.7. The vulnerability is in function getslide_child_action (library lib/admin/language_admin.php) where improper handling of the sid parameter enables SQL injection. The issue can be triggered remotely and has been publicly disclosed. No patch/versi...

CVE-2024-0523 CmsEasy language_admin.php getslide_child_action sql injection

A vulnerability was found in CmsEasy up to 7.7.7. It has been declared as critical. Affected by this vulnerability is the function getslidechildaction in the library lib/admin/languageadmin.php. The manipulation of the argument sid leads to sql injection. The attack can be launched remotely. The...

CmsEasy SQL Injection Vulnerability

CmsEasy is a content management system CMS for creating responsive websites from China's Kyushu Eaton Technology CmsEasy. A SQL injection vulnerability exists in CmsEasy version 7.7.7, which stems from the parameter sid of the function getslidechildaction that causes SQL injection...

PT-2024-15636 · Cmseasy · Cmseasy

Name of the Vulnerable Software and Affected Versions: CmsEasy versions up to 7.7.7 Description: A critical issue was found in the function getslide child action in the library lib/admin/language admin.php. The manipulation of the argument sid leads to sql injection. The attack can be launched...

CVE-2024-0523: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in CmsEasy up to 7.7.7. It has been declared as critical. Affected by this vulnerability is the function getslidechildaction in the library lib/admin/languageadmin.php. The manipulation of the argument sid leads to sql injection. The attack can be launched remotely. The...

CVE-2020-18406

An issue was discovered in cmseasy v7.0.0 that allows user credentials to be sent in clear text due to no encryption of form data...

CVE-2020-18406

An issue was discovered in cmseasy v7.0.0 that allows user credentials to be sent in clear text due to no encryption of form data...

Code injection

An issue was discovered in cmseasy v7.0.0 that allows user credentials to be sent in clear text due to no encryption of form data...

CVE-2020-18406

An issue was discovered in cmseasy v7.0.0 that allows user credentials to be sent in clear text due to no encryption of form data...

CVE-2020-18406: Insufficiently Protected Credentials

An issue was discovered in cmseasy v7.0.0 that allows user credentials to be sent in clear text due to no encryption of form data...

CVE-2020-18406

CVE-2020-18406 affects cmseasy v7.0.0 (CMS). The root cause is that form data is not encrypted, allowing user credentials to be sent in clear text. Several sources corroborate the issue and describe the impact as credential exposure over potentially plaintext channels. Documented risk factors inc...