CVE-2023-38490 Kirby XML External Entity (XXE) vulnerability in the XML data handler

Kirby is a content management system. A vulnerability in versions prior to 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6 only affects Kirby sites that use the Xml data handler e.g. Data::decode$string, 'xml' or the Xml::parse method in site or plugin code. The Kirby core does not use any of the...

CVE-2023-38489

CVE-2023-38489 – Kirby Insufficient Session Expiration (modeled across multiple sources) Kirby CMS versions prior to 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6 are affected. The vulnerability arises because old sessions were not invalidated when a user’s password was changed, allowing a previo...

CVE-2023-38488 Kirby vulnerable to field injection in the KirbyData text storage handler

Kirby is a content management system. A vulnerability in versions prior to 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6 affects all Kirby sites that might have potential attackers in the group of authenticated Panel users or that allow external visitors to update a Kirby content file e.g. via a...

CVE-2023-38488

CVE-2023-38488 is a field-injection vulnerability in Kirby’s KirbyData text storage handler. Affected versions include prior to 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6, impacting sites where authenticated Panel users or external visitors can write Kirby content files (e.g., via forms). The ...

CVE-2023-38488 Kirby vulnerable to field injection in the KirbyData text storage handler

Kirby is a content management system. A vulnerability in versions prior to 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6 affects all Kirby sites that might have potential attackers in the group of authenticated Panel users or that allow external visitors to update a Kirby content file e.g. via a...

CVE-2023-38488 Kirby vulnerable to field injection in the KirbyData text storage handler

Kirby is a content management system. A vulnerability in versions prior to 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6 affects all Kirby sites that might have potential attackers in the group of authenticated Panel users or that allow external visitors to update a Kirby content file e.g. via a...

Kirby 代码问题漏洞

Kirby is a file-based content management system CMS. A code issue vulnerability exists in Kirby versions 3.5.8.2 and earlier, 3.6.0 through 3.6.6.2, 3.7.0 through 3.7.5.1, 3.8.0 through 3.8.4, and 3.9.0 through 3.9.5, which arises from a change in a user's password by a user or site administrator...

Kirby 安全漏洞

Kirby is a file-based content management system CMS. A security vulnerability exists in Kirby versions 3.5.8.2 and earlier, 3.6.0 through 3.6.6.2, 3.7.0 through 3.7.5.1, 3.8.0 through 3.8.4, 3.9.0 through 3.9.5, and 3.9.0 and 3.9.5, which stems from an unspecified length of the Kirby authenticati...

October CMS 跨站脚本漏洞

October CMS is an open source content management system CMS based on PHP and Laravel web application framework. A security vulnerability exists in October CMS version v3.4.4, which stems from an arbitrary file upload vulnerability in October CMS...

Code injection

TYPO3 is an open source PHP based web content management system. Starting in version 9.4.0 and prior to versions 9.5.42 ELTS, 10.4.39 ELTS, 11.5.30, and 12.4.4, in multi-site scenarios, enumerating the HTTP query parameters id and L allowed out-of-scope access to rendered content in the website...

CVE-2023-38499

CVE-2023-38499 affects TYPO3 CMS in multi-site setups, where enumerating HTTP query parameters like id and L could disclose content from the frontend. Affected versions are 9.4.0–9.5.41 ELTS, 10.4.38 ELTS, 11.5.29, and 12.4.3; these are fixed in 9.5.42 ELTS, 10.4.39 ELTS, 11.5.30, and 12.4.4. The...

CVE-2023-38499 typo3/cms-core Information Disclosure due to Out-of-scope Site Resolution

TYPO3 is an open source PHP based web content management system. Starting in version 9.4.0 and prior to versions 9.5.42 ELTS, 10.4.39 ELTS, 11.5.30, and 12.4.4, in multi-site scenarios, enumerating the HTTP query parameters id and L allowed out-of-scope access to rendered content in the website...

Design/Logic Flaw

Contao is an open source content management system. Starting in version 4.0.0 and prior to versions 4.9.42, 4.13.28, and 5.1.10, it is possible for untrusted backend users to inject malicious code into headline fields in the back end, which will be executed both in the element preview back end an...

CVE-2023-36806

Contao XSS via input unit widget (CVE-2023-36806) affects Contao CMS versions prior to 4.9.42, 4.13.28, and 5.1.10 where untrusted backend users can inject code into headline fields, executed in backend previews and on the frontend. Root cause: lack of input validation in the widget used for head...

CVE-2023-34235

Strapi is an open-source headless content management system. Prior to version 4.10.8, it is possible to leak private fields if one is using the tnumber prefix. Knex query allows users to change the default prefix. For example, if someone changes the prefix to be the same as it was before or to...

CVE-2023-34235

Strapi (pre-4.10.8) is vulnerable to information disclosure due to a Knex query that allows changing the default field prefix (t(number)). If the t-number prefix is used, private fields like password can be exposed, as t1.password is not protected. The issue can lead to filtering attacks affectin...

CVE-2023-34235 Leaking sensitive user information still possible by filtering on private with prefix fields

Strapi is an open-source headless content management system. Prior to version 4.10.8, it is possible to leak private fields if one is using the tnumber prefix. Knex query allows users to change the default prefix. For example, if someone changes the prefix to be the same as it was before or to...

@antgineering-studio/strapi (4.5.5), @chargeover/strapi (0.0.1-rc1.1) +100 more potentially affected by CVE-2023-34235 via @strapi/utils (>=4.0.0, <=4.10.7)

@strapi/utils NPM version =4.0.0, =1.0.0, =1.3.0, =1.4.1 - @codeparticle/strapi-plugin-graphql 4.9.2 and more Source cves: CVE-2023-34235 Source advisory: OSV:GHSA-9XG4-3QFM-9W8F...

CVE-2023-34093

Strapi (open-source CMS) prior to version 4.10.8 is vulnerable to information disclosure due to improper handling of Content-Type attributes. The issue arises from the removal of the privateAttributes getter when users extend or modify content-types, which can cause any attribute to become public...

Insurance 跨站脚本漏洞

Insurance is a responsive business and insurance related web content management system CMS from the phpscriptpoint team. A cross-site scripting vulnerability exists in Insurance version 1.2, which stems from the inclusion of unknown functions in the file search.php, resulting in cross-site...