The vulnerability of the 1C-Bitrix website content management system, related to insufficient protection of registration data, allows a hacker to exploit SMTP settings and gain access to SMTP server authentication data.

The vulnerability of the 1C-Bitrix website content management system is related to insufficient protection of registration data. Exploiting this vulnerability allows a malicious actor to manipulate SMTP settings and gain access to SMTP server authentication data...

Exploit for Unrestricted Upload of File with Dangerous Type in Pluck-Cms Pluck

CVE-2023-50564 - Pluck CMS v4.7.18 Remote Code Execution RCE...

CVE-2024-48237

WTCMS 1.0 is vulnerable to Incorrect Access Control in \Common\Controller\HomebaseController.class.php...

mipjz 安全漏洞

mipjz is a content management system based on Baidu Mobile Accelerator MIP developed by sansanyun individual developer. mipjz 5.0.5 version of a security vulnerability, the vulnerability stems from the app agcontrollerApiAdminTag.php in the push method of the postAddress parameter is not handled...

OFSoft OFCMS 安全漏洞

OFSoft OFCMS is a content management system CMS developed in Java language by China Zhongtian Network OFSoft. A security vulnerability exists in OFSoft OFCMS version 1.1.2. An attacker can exploit this vulnerability to execute arbitrary code via the save method of the TemplateController.java file...

PT-2024-33048 · Wtcms · Wtcms

Name of the Vulnerable Software and Affected Versions: WTCMS version 1.0 Description: The issue is related to Incorrect Access Control in the CommonControllerHomebaseController.class.php file. Recommendations: For WTCMS version 1.0, consider restricting access to the HomebaseController.class.php...

mipjz 安全漏洞

mipjz is a content management system developed by sansanyun based on Baidu Mobile Accelerator MIP. A security vulnerability exists in mipjz version 5.0.5, which is caused by improper handling of the ICP parameter in appsettingcontrollerApiAdminSetting.php, which is susceptible to cross-site...

The vulnerability in the component soplanning/www/process/xajax_server.php of the SOPlanning CMS system allows a attacker to perform an XSS attack.

The vulnerability of the SOPlanning/www/process/xajaxserver.php component of the SOPlanning CMS system exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...

CVE-2024-10292

A vulnerability was found in ZZCMS 2023 and classified as critical. This issue affects some unknown processing of the file 3/Ebak5.1/upload/ChangeTable.php. The manipulation of the argument savefilename leads to unrestricted upload. The attack may be initiated remotely. The exploit has been...

CVE-2024-48926

Umbraco, a free and open source .NET content management system, has an insufficient session expiration issue in versions on the 13.x branch prior to 13.5.2, 10.x prior to 10.8.7, and 8.x prior to 8.18.15. The Backoffice displays the logout page with a session timeout message before the server...

CVE-2024-47819

Umbraco, a free and open source .NET content management system, has a cross-site scripting vulnerability starting in version 14.0.0 and prior to versions 14.3.1 and 15.0.0. This can be leveraged to gain access to higher-privilege endpoints, e.g. if you get a user with admin privileges to run the...

CVE-2024-48926

CVE-2024-48926 affects Umbraco CMS. The issue is an insufficient session expiration in the Backoffice where the logout page shows a timeout message ~30 seconds before the server session expires. Affected versions: 13.x prior to 13.5.2, 10.x prior to 10.8.7, and 8.x prior to 8.18.15. Patches are p...

CVE-2024-48925 Umbraco CMS Improper Access Control Vulnerability Allows Low-Privilege Users to Access Webhook API

Umbraco, a free and open source .NET content management system, has an improper access control issue starting in version 14.0.0 and prior to version 14.3.0. The issue allows low-privilege users to access the webhook API and retrieve information that should be restricted to users with access to th...

CVE-2024-47819

CVE-2024-47819 – Umbraco XSS (Dictionary section) Affected: Umbraco CMS (.NET) versions 14.0.0 up to, but not including, 14.3.1 and 15.0.0.Root cause: cross-site scripting vulnerability in the Dictionary section that can be triggered by an admin-privileged user to execute injected scripts.Impact:...

CVE-2024-47819 Umbraco CMS vulnerable to stored Cross-site Scripting in the "dictionary name" on Dictionary section

Umbraco, a free and open source .NET content management system, has a cross-site scripting vulnerability starting in version 14.0.0 and prior to versions 14.3.1 and 15.0.0. This can be leveraged to gain access to higher-privilege endpoints, e.g. if you get a user with admin privileges to run the...

Umbraco CMS 授权问题漏洞

Umbraco CMS is a content management system from Umbraco, Denmark. An authorization issue vulnerability exists in Umbraco CMS that stems from a server session not being fully terminated during an explicit logout...

PT-2024-33202 · Unknown · Dingfanzu Cms

Name of the Vulnerable Software and Affected Versions: dingfanzu CMS version 1.0 Description: The issue is a Cross-Site Request Forgery CSRF that allows a remote attacker to execute arbitrary code via the addPro parameter of the doAdminAction.php component. This enables unauthorized actions...

SHIRASAGI 安全漏洞

SHIRASAGI is a content management system of SHIRASAGI open source. A security vulnerability exists in versions prior to SHIRASAGI v1.19.1, which stems from improper handling of URLs in HTTP requests and is susceptible to path traversal attacks...

OFCMS cross-site scripting vulnerability (CNVD-2024-41671)

OFSoft OFCMS is a content management system CMS developed by China Zhongtian Network OFSoft using Java language. OFCMS version 1.1.2 cross-site scripting vulnerability, the vulnerability stems from the file /admin/system/dict/add.json?sqlid=system.dict.save parameter dictvalue on the user-supplie...

Zenario CMS Cross-Site Scripting Vulnerability

Zenario CMS is a Zenario open source application . Provides a Web-based content management system . A cross-site scripting vulnerability exists in Zenario CMS version 9.7.61188, which stems from the lack of effective filtering and escaping of user-supplied data in the "Organizer tags" field and c...