emlog 跨站脚本漏洞

emlog is a PHP and MySQL based CMS website builder by emlog's individual developers. A cross-site scripting vulnerability exists in emlog version 2.2.10. An attacker can exploit this vulnerability to perform cross-site scripting attacks...

PT-2024-3356 · Netcat · Netcat

Name of the Vulnerable Software and Affected Versions: Netcat affected versions not specified Description: The issue is related to a lack of restrictions on file uploads in the Netcat CMS system. This can be exploited by a remote attacker to execute arbitrary code or cause a denial of service...

CVE-2024-29022 Session Hijacking via XSS attack in header and session grid in Xibo CMS

Xibo is an Open Source Digital Signage platform with a web content management system and Windows display player software. In affected versions some request headers are not correctly sanitised when stored in the session and display tables. These headers can be used to inject a malicious script int...

CVE-2024-29022 Session Hijacking via XSS attack in header and session grid in Xibo CMS

Xibo is an Open Source Digital Signage platform with a web content management system and Windows display player software. In affected versions some request headers are not correctly sanitised when stored in the session and display tables. These headers can be used to inject a malicious script int...

CVE-2024-29022 Session Hijacking via XSS attack in header and session grid in Xibo CMS

Xibo is an Open Source Digital Signage platform with a web content management system and Windows display player software. In affected versions some request headers are not correctly sanitised when stored in the session and display tables. These headers can be used to inject a malicious script int...

CVE-2024-29023 Session Hijacking via token exposure on the session page in Xibo CMS

Xibo is an Open Source Digital Signage platform with a web content management system and Windows display player software. Session tokens are exposed in the return of session search API call on the sessions page. Subsequently they can be exfiltrated and used to hijack a session. Users must be...

CVE-2024-29023

CVE-2024-29023 affects Xibo CMS: session tokens are exposed in the session-search API response, enabling potential session hijacking when users have access to the sessions page. Affected software is Xibo: upgrades are recommended to close the issue. Remediation per sources: Upgrade to Xibo 3.3.10...

Desdev DedeCMS SQL注入漏洞

Desdev DedeCMS Dream Weaving Content Management System is a PHP-based open source content management system CMS from China's Zhuozhuo Network Desdev. The system features content publishing, content management, content editing and content retrieval. DedeCMS 5.7.112-UTF8 has a SQL injection...

Xibo 安全漏洞

Xibo is an open source content management system from Xibo Digital Signage. A security vulnerability exists in Xibo that originates from a session hijacking via token exposure on a session page...

Dice 跨站脚本漏洞

Dice is a personal content management CMS system with a separate front-end and back-end. A cross-site scripting vulnerability exists in Dice version 3.1.0. An attacker could exploit this vulnerability to perform a cross-site scripting attack...

Adobe Experience Manager cross-site scripting vulnerability (CNVD-2024-17894)

Adobe Experience Manager AEM is a set of content management solutions that can be used to build websites, mobile applications and forms from the American company Odobie Adobe. The program supports mobile content management, marketing and sales campaign management and multi-site management. A...

a-blog cms 安全漏洞

a-blog cms is a Japanese content management system CMS. A security vulnerability exists in a-blog cms that stems from vulnerability to server-side request forgery attacks...

a-blog cms 安全漏洞

a-blog cms is a Japanese content management system CMS. A security vulnerability exists in versions of a-blog cms before Ver.3.1.12, before Ver.3.0.32, before Ver.2.11.61, before Ver.2.10.53, which originated from a vulnerability that could allow an attacker to log in to the product and execute...

The Essential Tools and Plugins for WordPress Development

By Owais Sultan WordPress, a widely used content management system, owes a great deal of its flexibility to plugins. These small… This is a post from HackRead.com Read the original post: The Essential Tools and Plugins for WordPress Development...

CVE-2024-30262

Contao CVE-2024-30262: In versions prior to 4.13.40, when a frontend member changes their password (in Personal Data or Password Lost modules), associated remember-me tokens are not cleared, allowing ongoing access if a token was compromised. The issue is fixed in Contao 4.13.40. A recommended wo...

CVE-2024-28235 Contao possible cookie sharing with external domains while checking protected pages for broken links

Contao is an open source content management system. Starting in version 4.9.0 and prior to versions 4.13.40 and 5.3.4, when checking for broken links on protected pages, Contao sends the cookie header to external urls as well, the passed options for the http client are used for all requests. Cont...

CVE-2024-28235

The CVE-2024-28235 entry concerns Contao (open-source CMS). Affected: Contao 4.9.0 up to 4.13.39 and 5.x up to 5.3.3. Root cause: when the crawler checks protected pages for broken links, the HTTP client options are applied to all requests, causing the cookie header to be sent to external URLs. I...

CVE-2024-28235 Contao possible cookie sharing with external domains while checking protected pages for broken links

Contao is an open source content management system. Starting in version 4.9.0 and prior to versions 4.13.40 and 5.3.4, when checking for broken links on protected pages, Contao sends the cookie header to external urls as well, the passed options for the http client are used for all requests. Cont...

CVE-2024-28191 Contao may have unencoded insert tags in the frontend

Contao is an open source content management system. Starting in version 4.0.0 and prior to version 4.13.40 and 5.3.4, it is possible to inject insert tags in frontend forms if the output is structured in a very specific way. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a...

CVE-2024-28190 Contao core bundle vulnerable to cross site scripting in the file manager

Contao is an open source content management system. Starting in version 4.0.0 and prior to version 4.13.40 and 5.3.4, users can inject malicious code in filenames when uploading files back end and front end, which is then executed in tooltips and popups in the back end. Contao versions 4.13.40 an...