8449 matches found
bloofoxCMS SQL注入漏洞
bloofoxCMS is bloofox bloofoxCMS individual developers of a Php-based text content management system. A security vulnerability exists in bloofoxCMS version v0.5.2.1, which stems from a tid parameter found to contain an SQL injection vulnerability via...
Grav 代码注入漏洞
Grav is an extensible CMS Content Management System for personal blogs, small content publishing platforms, and one-page product displays. A code injection vulnerability exists in Grav versions prior to 1.7.42, which stems from the presence of a server-side template injection SSTI vulnerability...
Grav 代码注入漏洞
Grav is a scalable CMS Content Management System for personal blogs, small content publishing platforms, and one-page product displays. A security vulnerability exists in Grav versions prior to 1.7.42, which stems from a server-side template injection SSTI vulnerability...
CVE-2023-34247 @keystone-6/auth Open Redirect vulnerability
Keystone is a content management system for Node.JS. There is an open redirect in the @keystone-6/auth package versions 7.0.0 and prior, where the redirect leading / filter can be bypassed. Users may be redirected to domains other than the relative host, thereby it might be used by attackers to...
FUEL CMS SQL注入漏洞
FUEL CMS is a content management system CMS based on the Codelgniter framework. A security vulnerability exists in FUEL CMS v1.5.2, which is caused by an SQL injection vulnerability in the id parameter of the /controllers/Blocks.php page...
CVE-2023-33604
Imperial CMS v7.5 was discovered to contain an arbitrary file deletion vulnerability via the DelspReFile function in /sp/ListSp.php. This vulnerability is exploited by attackers via a crafted POST request...
PT-2023-24403 · Unknown · Imperial Cms
Name of the Vulnerable Software and Affected Versions: Imperial CMS version 7.5 Description: The issue allows for arbitrary file deletion via the DelspReFile function in the /sp/ListSp.php API endpoint. Attackers can exploit this by sending a crafted POST request to the vulnerable endpoint...
openssl: use-after-free following BIO_new_NDEF
A use-after-free vulnerability was found in OpenSSL's BIOnewNDEF function. The public API function BIOnewNDEF is a helper function used for streaming ASN.1 data via a BIO. It is primarily used internally by OpenSSL to support the SMIME, CMS, and PKCS7 streaming capabilities, but it may also be...
CVE-2023-33690
SonicJS up to v0.7.0 allows attackers to execute an authenticated path traversal when an attacker injects special characters into the filename of a backup CMS...
emlog 代码问题漏洞
emlog is a PHP and MySQL based CMS builder for emlog personal developers. A code issue vulnerability exists in emlog version 6.0.0, which stems from a file upload vulnerability in /admin/plugin.php. An attacker can exploit this vulnerability to elevate privileges...
YFCMF 安全漏洞
YFCMF is a software application. It provides a lightweight enterprise website management system. A security vulnerability exists in YFCMF before 3.0.4, which stems from unknown code in index.php that causes path traversal...
Pimcore path traversal vulnerability (CNVD-2023-43860)
Pimcore is Austria Pimcore company's set of open source for creating and managing Web applications Web content management platform. The platform integrates Web content management, e-commerce framework and product information management applications. A path traversal vulnerability exists in versio...
CVE-2023-33181
Xibo is a content management system CMS. Starting in version 3.0.0 and prior to version 3.3.5, some API routes will print a stack trace when called with missing or invalid parameters revealing sensitive information about the locations of paths that the server is using. Users should upgrade to...
CVE-2023-33181 Sensitive Information Disclosure abusing Stack Trace in Xibo CMS
Xibo is a content management system CMS. Starting in version 3.0.0 and prior to version 3.3.5, some API routes will print a stack trace when called with missing or invalid parameters revealing sensitive information about the locations of paths that the server is using. Users should upgrade to...
CVE-2023-33181
CVE-2023-33181 affects Xibo CMS. From version 3.0.0 up to 3.3.4, some API routes emit a stack trace on calls with missing or invalid parameters, exposing sensitive information about server path locations. Upgrade to version 3.3.5 to fix the issue; there are no public workarounds besides upgrading...
CVE-2023-33180 Sensitive Information Disclosure abusing SQL Injection in Xibo CMS display map
Xibo is a content management system CMS. An SQL injection vulnerability was discovered starting in version 3.2.0 and prior to version 3.3.2 in the /display/map API route inside the CMS. This allows an authenticated user to exfiltrate data from the Xibo database by injecting specially crafted valu...
CVE-2023-33177
Xibo is a content management system CMS. A path traversal vulnerability exists in the Xibo CMS whereby a specially crafted zip file can be uploaded to the CMS via the layout import function by an authenticated user which would allow creation of files outside of the CMS library directory as the...
SeaCMS Denial of Service Vulnerability (CNVD-2024-37629)
SeaCMS is designed to solve the core needs of station owners and content management system, a set of programs to adapt to computers, cell phones, tablets, APP multiple terminal entrances, without any encryption code, safe and secure, is the best station building tools. SeaCMS 11.6 version of the...
Xibo 路径遍历漏洞
Xibo is an open source content management system from Xibo Digital Signage. A security vulnerability exists in Xibo that stems from a path traversal vulnerability that allows an authenticated user to upload a specially crafted zip file to the CMS, which would allow a user acting as a web server t...