CVE-2024-29181 @strapi/plugin-content-manager leaks data via relations via the Admin Panel

Strapi is an open-source content management system. Prior to version 4.19.1, a super admin can create a collection where an item in the collection has an association to another collection. When this happens, another user with Author Role can see the list of associated items they did not create...

Strapi Security Vulnerabilities

Strapi is an open source content management system CMS. A security vulnerability exists in Strapi versions prior to 4.22.0 that stems from a denial-of-service vulnerability in the media upload process that causes the server to crash...

SeaCMS Security Vulnerability

SeaCMS is a free, open source web content management system written in PHP. The system is primarily designed to manage video-on-demand resources. A security vulnerability exists in SeaCMS version 12.9. An attacker can exploit the vulnerability to delete files via admintemplate.php...

The functionality of the pages.php component in the Content Management System allows a hacker to execute arbitrary code or enhance their privileges.

The vulnerability of the pages.php component in the Content Management System software is related to the failure to implement measures to protect the SQL query structure. Exploiting this vulnerability allows an attacker to execute arbitrary code or gain increased privileges...

CVE-2024-37160 Formwork has a Cross-site scripting (XSS) vulnerability in Description metadata

Formwork is a flat file-based Content Management System CMS. An attackers requires administrator privilege to execute arbitrary web scripts by modifying site options via /panel/options/site. This type of attack is suitable for persistence, affecting visitors across all pages except the dashboard...

Formwork Cross-Site Scripting Vulnerability

Formwork is Formwork open source a flat file based content management system CMS. It is used to build and manage simple websites. A cross-site scripting vulnerability exists in Formwork versions prior to 1.13.1, which originates from a vulnerability that allows an attacker to execute arbitrary we...

The vulnerability of the /ms/file/upload.do file in the MCms content management system allows a hacker to upload any files they desire.

The vulnerability of the /ms/file/upload.do file in the MCms content management system is related to the ability to download files of a dangerous type without restrictions. Exploiting this vulnerability allows a malicious actor to download any files by sending a specially crafted POST request...

The vulnerability of the Ghost content management system, related to the lack of measures taken to protect the website structure, allows attackers to carry out XSS attacks.

The vulnerability of the Ghost content management system is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks by sending a specially created malicious SVG file containing JavaScript code to port...

CVE-2024-35228

Wagtail is an open source content management system built on Django. Due to an improperly applied permission check in the wagtail.contrib.settings module, a user with access to the Wagtail admin and knowledge of the URL of the edit view for a settings model can access and update that setting, eve...

CVE-2024-35228 Improper Handling of Insufficient Permissions in Wagtail

Wagtail is an open source content management system built on Django. Due to an improperly applied permission check in the wagtail.contrib.settings module, a user with access to the Wagtail admin and knowledge of the URL of the edit view for a settings model can access and update that setting, eve...

SAP Enable Now Manager Authorization Issues Vulnerability

SAP Enable Now Manager is the central content management and collaboration platform from SAP. An authorization issue vulnerability exists in SAP Enable Now Manager, which stems from a failure to perform the required authorization checks on authenticated users, and can be exploited by an attacker ...

MinMax CMS 安全漏洞

MinMax CMS is a content management system. A security vulnerability exists in MinMax CMS that stems from the application containing a hidden administrator account with a fixed password that cannot be removed or disabled from the administrative interface...

Formwork 安全漏洞

Formwork is a flat file based content management system CMS from Formwork open source. It is used to build and manage simple websites. A security vulnerability exists in formwork versions prior to 1.13.0, which stems from a cross-site scripting XSS vulnerability in the Content field...

PT-2024-40086 · Packagist · Silverstripe/Framework

Name of the Vulnerable Software and Affected Versions: No specific software or versions mentioned. Description: The issue concerns the reports CMS section, where it only checks the canView function when listing reports that can be viewed by the current user. However, it does not perform this chec...

PT-2024-40536 · Packagist · Silverstripe/Framework

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned. Description: A security issue allows a member with the EDIT PERMISSIONS permission and access to the "Security" section to escalate their privileges to ADMIN level by re-assigning themselves or...

PT-2024-40256 · Packagist · Silverstripe/Framework

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned. Description: A weakness in the .htaccess rules allows PHP scripts in the assets directory to be executed through a specially crafted URL. However, protections are in place to prevent the upload ...

PT-2024-40381 · Microsoft · Office Excel

Name of the Vulnerable Software and Affected Versions: CMS affected versions not specified Description: The issue concerns the CSV export feature of the CMS, where the output can contain macros and scripts. If these are imported into software like Microsoft Excel without proper sanitization, they...

PT-2024-40127 · Packagist · Silverstripe Cms

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned. Description: A cross-site scripting issue has been found in the CMS page history tab. This can be exploited if a user with CMS access posts malicious or unescaped HTML into any text fields on a...

PT-2024-40450 · Unknown · Virtualpage

Name of the Vulnerable Software and Affected Versions: VirtualPage affected versions not specified Description: A cross-site scripting issue has been found in the VirtualPage class. This can be exploited if a user with CMS access posts malicious or unescaped HTML into any of the text fields of a...

Umbraco CMS 跨站脚本漏洞

Umbraco CMS is a content management system from Umbraco, Denmark. A security vulnerability exists in Umbraco CMS that stems from the presence of stored cross-site scripting XSS, which enables an attacker to bring malicious content into a website or application...