Craft CMS has a theoretical bypass for CVE-2025-23209

Pre-requisites: Have a compromised security key https://craftcms.com/knowledge-base/securing-craftkeep-your-secrets-secret Somehow, manage to create an arbitrary file in Craft’s /storage/backups folder. With those two pieces in place, you could create a specific, malicious request to the...

CVE-2012-10042 Sflog! CMS 1.0 Arbitrary File Upload RCE

Sflog! CMS 1.0 contains an authenticated arbitrary file upload vulnerability in the blog management interface. The application ships with default credentials admin:secret and allows authenticated users to upload files via manage.php. The upload mechanism fails to validate file types, enabling...

Sourceforge sflog! 安全漏洞

Sourceforge sflog! is an open source content management system from Sourceforge. A security vulnerability exists in version 1.0 of Sourceforge sflog!, which stems from the blog management interface not validating file types, and could lead to arbitrary file uploads and remote code execution...

Grav CMS Admin Direct Install Authenticated Plugin Upload RCE

Grav CMS version use exploit/multi/http/grav/admindirectinstallrcecve202550286 msf undefinedadmindirectinstallrcecve202550286 show actions ...actions... msf undefinedadmindirectinstallrcecve202550286 set ACTION msf undefinedadmindirectinstallrcecve202550286 show options ...show and set options...

Grav CMS 安全漏洞

Grav CMS is Grav open source a flat file-based content management system . Grav CMS suffers from a remote code execution vulnerability that originates from allowing authenticated administrators to upload malicious plugins via the admin/tools/direct-install interface, which can be exploited by an...

ClanSphere 安全漏洞

ClanSphere is a web content management system from the ClanSphere organization. A security vulnerability exists in ClanSphere version 2011.3 that stems from not properly handling the cslang cookie parameter, which could lead to local file inclusion...

Concrete CMS 安全漏洞

Concrete CMS is a team-oriented open source content management system from Concrete CMS Open Source. A security vulnerability exists in Concrete CMS versions 9 through 9.4.2, which stems from a stored cross-site scripting vulnerability in the Members Dashboard page...

Vvveb 注入漏洞

Vvveb is a powerful and easy-to-use CMS from Givan Individual Developers for building websites, blogs or e-commerce stores. An injection vulnerability exists in Vvveb version 1.0.5, which stems from code injection due to a misbehavior of the function Save in the file...

CVE-2025-50270

A stored Cross Site Scripting xss vulnerability in the "content management" feature in AnQiCMS v.3.4.11 allows a remote attacker to execute arbitrary code via a crafted script to the title, categoryTitle, and tmpTag parameters...

CVE-2025-50270

A stored Cross Site Scripting xss vulnerability in the "content management" feature in AnQiCMS v.3.4.11 allows a remote attacker to execute arbitrary code via a crafted script to the title, categoryTitle, and tmpTag parameters...

Exploit for CVE-2025-50754

CVE-2025-50754 Stored XSS to Remote Code Execution in a PHP-...

CS Cart 安全漏洞

CS Cart is an e-commerce system from the US-based company CS Cart. A security vulnerability exists in CS Cart version 4.18.3, which stems from an under-restricted file upload feature that could lead to the execution of arbitrary code...

PT-2025-31527 · Anqicms · Anqicms

Name of the Vulnerable Software and Affected Versions: AnQiCMS version 3.4.11 Description: A stored Cross Site Scripting xss vulnerability exists in the "content management" feature. A remote attacker can execute arbitrary code by providing a crafted script to the title, categoryTitle, and tmpTag...

The vulnerability of the Adobe Experience Manager content and media data management system lies in the insufficient protection of the website structure, allowing attackers to execute arbitrary code.

The vulnerability of the Adobe Experience Manager content and media data management system is related to insufficient protection of the website structure. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

CVE-2025-27800

The Episerver Content Management System CMS by Optimizely was affected by multiple Stored Cross-Site Scripting XSS vulnerabilities. This allowed an authenticated attacker to execute malicious JavaScript code in the victim's browser. The Admin dashboard offered the functionality to add gadgets to...

CVE-2025-27800

CVE-2025-27800 corresponds to multiple stored XSS flaws in Optimizely Episerver CMS (EPiServer.CMS.Core/UI) affecting 11.x (<11.21.4 core and <11.37.5 UI) and 12.x (<12.22.1 core and

CVE-2025-54380

Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to version 17.6, Opencast would incorrectly send the hashed global system account credentials ie: org.opencastproject.security.digest.user and org.opencastproject.security.digest.pass...

Optimizely Episerver Content Management System 安全漏洞

Optimizely Episerver Content Management System is an enterprise-class content management system from Optimizely, Inc. A security vulnerability exists in the Optimizely Episerver Content Management System that stems from stored cross-site scripting that allows an authenticated attacker to execute...

Optimizely Episerver Content Management System 安全漏洞

Optimizely Episerver Content Management System is an enterprise-class content management system from Optimizely, Inc. A security vulnerability exists in the Optimizely Episerver Content Management System that stems from stored cross-site scripting that allows an authenticated attacker to execute...

CVE-2025-34139

A vulnerability exists in Sitecore Experience Manager XM, Experience Platform XP, Experience Commerce XC, and Managed Cloud that could allow an unauthenticated attacker to read arbitrary files. This vulnerability affects all Experience Platform topologies XM, XP, XC from 8.0 Initial Release throu...