CVE-2018-11679

An issue was discovered in CmsEasy 6.120180508. There is a CSRF vulnerability that can add an article via /index.php?case=table&act=add&table=archive&admindir=admin...

CVE-2018-11679

An issue was discovered in CmsEasy 6.120180508. There is a CSRF vulnerability that can add an article via /index.php?case=table&act=add&table=archive&admindir=admin...

CVE-2018-11680

An issue was discovered in CmsEasy 6.120180508. There is a CSRF vulnerability in the rich text editor that can add an IFRAME element. This might be used in a DoS attack if a referenced remote URL is refreshed at a rapid rate...

CVE-2018-11680

An issue was discovered in CmsEasy 6.120180508. There is a CSRF vulnerability in the rich text editor that can add an IFRAME element. This might be used in a DoS attack if a referenced remote URL is refreshed at a rapid rate...

CVE-2018-11679

An issue was discovered in CmsEasy 6.120180508. There is a CSRF vulnerability that can add an article via /index.php?case=table&act=add&table=archive&admindir=admin...

CVE-2018-11680

CmsEasy 6.1_20180508 contains a CSRF in the rich text editor that can inject an IFRAME element. This could be exploited to cause a DoS if a referenced remote URL is refreshed rapidly. No exploit details or remediation information are provided in the connected documents.

CVE-2018-11679

CVE-2018-11679 affects CmsEasy 6.1_20180508. The connected documents describe a CSRF vulnerability that can add an article via the URL /index.php?case=table&act=add&table=archive&admin_dir=admin. The vulnerability details are consistently stated across sources; no explicit patch version or mitiga...

Code Execution Vulnerability in CmsEasy v5.7

CMSeasy is a web content management system based on PHP+Mysql architecture and a PHP development platform. The use of modular development, easy to use features easy to expand, can be oriented to large and medium-sized sites to provide heavyweight website construction solutions. CmsEasy v5.7 versi...

Cross-site scripting vulnerability in CmsEasy frontend

CmsEasy is a website content management system based on PHP+Mysql architecture and a PHP development platform. A cross-site scripting vulnerability exists in the CmsEasy frontend, which can be exploited by attackers to execute arbitrary JavaScript code...

Multiple Vulnerabilities in CmsEasy latest version V5.6

CmsEasy is a web content management system based on PHP+Mysql architecture and a PHP development platform. Multiple vulnerabilities exist in CmsEasy latest version V5.6. An attacker can exploit this vulnerability to compromise the confidentiality, integrity, and availability of the system...

File inclusion vulnerability in cmseasy '/lib/plugins/filecheck/action.php' page

CmsEasy is a web content management system based on PHP+Mysql architecture. A file inclusion vulnerability exists in the cmseasy '/lib/plugins/filecheck/action.php' page. As the 'Logtype' parameter is not restricted in any way, it allows an attacker to exploit the vulnerability to obtain sensitiv...

CmsEasy front Desk arbitrary code execution vulnerability

Source link: https://xianzhi.aliyun.com/forum/read/215.html 在补丁页面http://www.cmseasy.cn/patch/show1116.html下载补丁CmsEasyforUploads20161012.zip Modified files no more 通过diff发现补丁中lib/default/toolact.php 392 row cutimageactionfunction is commented out Take a look at this function php /function...

cmseasy /imageUp.php xss vulnerability

No description provided by source...

Cmseasy website builder system has cross-site scripting vulnerability

cmseasy is a domestic commercial website builder system that is used for corporate website building. A vulnerability exists in the cmseasy backend code that does not properly filter dangerous characters, allowing attackers to exploit the vulnerability to conduct cross-site attacks...

Cmseasy多处CSRF

No description provided by source...

cmseasy demo.php 反射型XSS漏洞

No description provided by source...

cmseasy 5.6 index.php 网站路径泄露漏洞

No description provided by source...

CmsEasy_5.5_UTF-8_20140118 celive\include\database.class.php 任意sql语句执行漏洞

No description provided by source...

CmsEasy 5.6 /celive/live/header.php SQL注入漏洞

整个漏洞详情在书安杂志中进行了详细的说明。链接：https://www.secbook.net在parseObjXml 凼数中$rootTag 就是传入的 xml 中的第一个标签，返里判断是 xjxobj 还是 xjxquery当$rootTag 为 xjxquery 时将传入的参数内容通过 parsestr 处理 parsestr$sQuery, $aArray;然后当 getmagicquotesgpc == 1 == on的时候候，将传入的参数值反转义$newArray$sKey = stripslashes$sValue;进入postdata函数。function...

cmseasy 无限制报错注入（php函数的坑）

简要描述： cmseasy 无限制报错注入（可获取全站信息exp） 详细说明： 问题还是出在clive 上面，但是跟以往的不同的是，xjxquery 这个上面就发生了问题，看代码： xajax.class.php: if $rootTag == "xjxquery" $sQuery = ""; $this-iPos++; while !stristr$this-aObjArray$this-iPos, "" if stristr$this-aObjArray$this-iPos, "" || stristr$this-aObjArray$this-iPos, "" $this-iPos+...