CVE-2023-40028 Arbitrary file read via symlinks in Ghost

Ghost is an open source content management system. Versions prior to 5.59.1 are subject to a vulnerability which allows authenticated users to upload files that are symlinks. This can be exploited to perform an arbitrary file read of any file on the host operating system. Site administrators can...

Ghost Foundation Ghost 后置链接漏洞

Ghost is an open source content management system . Ghost suffers from an arbitrary file read vulnerability that stems from the program failing to properly filter for special elements in a resource or file path. An attacker can exploit this vulnerability to read arbitrary files...

ThinkCMF Cross-Site Scripting Vulnerability

ThinkCMF is a CMS Content Management System based on ThinkPHP. A cross-site scripting vulnerability exists in ThinkCMF version 5.1.5, which stems from the lack of effective filtering and escaping of user-supplied data in the file UserController.php, and can be exploited by an attacker to execute...

SEMCMS File Upload Vulnerability

SEMCMS is a foreign trade web content management system CMS that supports multiple languages. A file upload vulnerability exists in SEMCMS version 3.9, which stems from the application's lack of effective validation of uploaded files and can be exploited by an attacker to run arbitrary code via...

superMicro CMS Security Vulnerability

superMicro CMS is a website builder by Patrick Taylor, an individual developer. A security vulnerability exists in superMicro CMS version 3.11, which originates from an arbitrary file deletion vulnerability in the file images.php. The vulnerability can be exploited by an attacker to delete...

Gila CMS 跨站脚本漏洞

Gila CMS is an open source content management system CMS based on PHP and MySQL. A cross-site scripting vulnerability exists in Gila CMS version 1.11.3, which stems from the lack of effective filtering and escaping of user-supplied data by the parameter admuser, and can be exploited by an attacke...

PT-2023-4718 · Unknown · Netcat Cms

Name of the Vulnerable Software and Affected Versions: Netcat CMS affected versions not specified Description: The issue is related to a URL redirection vulnerability in the Netcat CMS system. This vulnerability can be exploited by a remote attacker to redirect users to an arbitrary URL address...

Moderate: Red Hat Security Advisory: RHUI 4.5.0 release - Security, Bug Fixes, and Enhancements

An updated version of Red Hat Update Infrastructure RHUI is now available. RHUI 4.5 fixes several security and operational bugs and also adds several new features. Red Hat Update Infrastructure RHUI offers a highly scalable, highly redundant framework that enables you to manage repositories and...

Session Fixation in Guardian/CMC before 22.6.2

Summary In certain conditions, depending on timing and the usage of the Chrome web browser, Guardian/CMC versions before 22.6.2 do not always completely invalidate the user session upon logout. Thus an authenticated local attacker may gain acces to the original user's session. Impact Unauthorized...

Textpattern CMS Path Traversal Vulnerability

Textpattern CMS is a Php-based content management system from the Textpattern team. A security vulnerability exists in Textpattern CMS version v4.8.8. A remote attacker can exploit the vulnerability to execute arbitrary code and access sensitive information via the plugin upload function...

CVE-2023-34377

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Joseph C Dolson My Content Management plugin = 1.7.6 versions...

CVE-2023-34377

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Joseph C Dolson My Content Management plugin = 1.7.6 versions...

Cross site scripting

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Joseph C Dolson My Content Management plugin = 1.7.6 versions...

CVE-2023-34377

CVE-2023-34377 is a stored XSS vulnerability in the WordPress plugin My Content Management by Joseph C Dolson , affecting versions up to and including 1.7.6 . The issue requires admin+ authentication to exploit and is described as a stored XSS affecting user input handling. Public CVSS metrics va...

CVE-2023-34377: Improper Neutralization of Input During Web Page Generation

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Joseph C Dolson My Content Management plugin = 1.7.6 versions...

idreamsoft iCMS SQL Injection Vulnerability

idreamsoft iCMS is an open source content management system CMS based on PHP and MySQL. A SQL injection vulnerability exists in idreamsoft iCMS. No information about this vulnerability is available at this time, please stay tuned to CNNVD or vendor announcements...

DedeBIZ 跨站脚本漏洞

DedeBIZ is a content management system from China Muyun Intelligent Technology DedeBIZ company. A cross-site scripting vulnerability exists in DedeBIZ version 6.2.10, which stems from the Article Handler component can lead to cross-site scripting vulnerability. No detailed vulnerability details a...

WordPress plugin My Content Management cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...

idreamsoft iCMS Cross-Site Scripting Vulnerability

idreamsoft iCMS is an open source content management system CMS based on PHP and MySQL. A cross-site scripting vulnerability exists in versions prior to idreamsoft iCMS 2.16.1-git. An attacker can exploit this vulnerability to perform cross-site scripting attacks...

Security feature bypass

Sulu is an open-source PHP content management system based on the Symfony framework. It allows over the Admin Login form to detect which user username, email exists and which one do not exist. Sulu Installation not using the old Symfony 5.4 security System and previous version are not impacted by...