Atom CMS SQL注入漏洞

Atom CMS is an open source content management system from The Digital Craft. An SQL injection vulnerability exists in Atom CMS version 2.0, which stems from an unverified SQL injection in the id parameter of the admin index page, which could lead to a remote attacker manipulating database queries...

Schlix CMS 安全漏洞

Schlix CMS is an open source content management system CMS based on PHP and MySQL from Schlix. A security vulnerability exists in Schlix CMS versions prior to v2.2.9-5, which stems from a missing javascript cleanup in the login form, which could lead to an XSS attack in the admin panel...

Umbraco CMS 安全漏洞

Umbraco CMS is a content management system from Umbraco, Denmark. A security vulnerability exists in Umbraco CMS version v16.3.3, which stems from the fact that uploading a specially crafted PDF file may result in the execution of arbitrary code...

PT-2025-52674

Name of the Vulnerable Software and Affected Versions Umbraco CMS version 16.3.3 Description An arbitrary file upload issue exists in Umbraco CMS version 16.3.3. Attackers can potentially execute arbitrary code by uploading a specially crafted PDF file. The supplier disputes responsibility, stati...

CVE-2023-53936

Cameleon CMS 2.7.4 contains a persistent cross-site scripting vulnerability that allows authenticated administrators to inject malicious scripts into post titles. Attackers can create posts with embedded SVG scripts that execute when other users mouse over the post title, potentially stealing...

📄 Lepton CMS 7.4.0 Cross Site Scripting / Code Execution

Lepton CMS version 7.4.0 has a vulnerability which allows for a persistent cross site scripting payload to escalate into PHP execution through the droplet engine...

CVE-2023-53909

WBCE CMS 1.6.1 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious JavaScript by uploading crafted SVG files through the media manager. Attackers can upload SVG files containing script tags to the...

CVE-2023-53936

CVE-2023-53936 affects Camaleon CMS 2.7.4. The flaw is a persistent cross-site scripting (XSS) vulnerability that allows authenticated administrators to inject malicious scripts into post titles. Attackers can create posts with embedded SVG scripts that execute when other users mouse over the pos...

CVE-2023-53936 Cameleon CMS 2.7.4 Authenticated Persistent Cross-Site Scripting via Post Creation

Cameleon CMS 2.7.4 contains a persistent cross-site scripting vulnerability that allows authenticated administrators to inject malicious scripts into post titles. Attackers can create posts with embedded SVG scripts that execute when other users mouse over the post title, potentially stealing...

EUVD-2023-60221

WBCE CMS 1.6.1 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious JavaScript by uploading crafted SVG files through the media manager. Attackers can upload SVG files containing script tags to the...

CVE-2025-14836 ZZCMS User Data Storage user_save.php cleartext storage in file

A flaw has been found in ZZCMS 2025. Affected by this vulnerability is an unknown functionality of the file /reg/usersave.php of the component User Data Storage Module. This manipulation causes cleartext storage in a file or on disk. Remote exploitation of the attack is possible. The exploit has...

CVE-2023-53927

The CVE-2023-53927 issue affects PHPJabbers Simple CMS 5.0. It is a stored cross-site scripting vulnerability in the section name parameter, allowing authenticated attackers to insert JavaScript payloads that execute when administrators view sections. The risk is described as client-side code exe...

CVE-2023-53910 WBCE CMS 1.6.1 Stored Cross-Site Scripting via Page Content

WBCE CMS 1.6.1 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious JavaScript by inserting script tags into page content through the WYSIWYG editor. Attackers can submit POST requests to /wbce/modules/wysiwyg/save.php with malicious script...

CVE-2023-53909

WBCE CMS 1.6.1 is affected by a stored XSS caused by uploading crafted SVG files via the media manager to /wbce/modules/elfinder/ef/php/connector.wbce.php. Authenticated attackers can inject JavaScript that executes when victims access the uploaded file. Public-facing details confirm affected pro...

CVE-2025-67165

An Insecure Direct Object Reference IDOR in Pagekit CMS v1.0.18 allows attackers to escalate privileges...

CVE-2025-65590

nopCommerce 4.90.0 is vulnerable to Cross Site Scripting XSS via the Blog posts functionality in the Content Management area...

Sitemagic CMS 代码问题漏洞

Sitemagic CMS is a scalable content management system CMS. A code issue vulnerability exists in Sitemagic CMS version 4.4.3, which stems from improper file upload functionality and could lead to remote code execution...

CVE-2025-67164

Pagekit CMS v1.0.18 is affected by an authenticated arbitrary file upload vulnerability in the /storage/poc.php component. Uploading a crafted PHP file allows attackers to execute arbitrary code on the server. The root cause is an insecure file upload vector within the storage component, enabling...

WBCE CMS 跨站脚本漏洞

WBCE CMS is a PHP and MySQL based open source content management system CMS from WBCE CMS Open Source. A cross-site scripting vulnerability exists in WBCE CMS version 1.6.1, which stems from improper cleanup when uploading SVG files and could lead to a stored cross-site scripting attack...

PT-2025-51979

Name of the Vulnerable Software and Affected Versions ZZCMS version 2025 Description A security issue exists in ZZCMS 2025 related to the User Data Storage Module. A flaw within the /reg/user save.php file results in the storage of data in cleartext on a file or disk. Remote exploitation is...