8449 matches found
Backdrop CMS 跨站脚本漏洞
Backdrop CMS is an open source content management system CMS. A security vulnerability exists in Backdrop CMS versions prior to 1.24.2. An attacker can exploit this vulnerability to inject arbitrary web script or html code via the name parameter...
CVE-2023-29774
Dreamer CMS 3.0.1 is vulnerable to stored Cross Site Scripting XSS...
Desdev DedeCMS SQL注入漏洞
Desdev DedeCMS Dream Weaving Content Management System is a PHP-based open-source content management system CMS of China Zhuozhuo network Desdev company. The system has the functions of content publishing, content management, content editing and content retrieval. A security vulnerability exists ...
PT-2023-14177 · Unknown · Dreamer Cms
Name of the Vulnerable Software and Affected Versions: Dreamer CMS version 4.0.1 Description: The issue allows SQL injection via ArchivesMapper.xml. Recommendations: For Dreamer CMS version 4.0.1, consider restricting access to ArchivesMapper.xml to minimize the risk of exploitation. As a tempora...
SIYUCMS suffers from an arbitrary file deletion vulnerability (CNVD-2023-50754)
SIYUCMS is a content management system based on the latest version of ThinkPHP-5.1.X framework with AdminLTE in the backend front-end framework. SIYUCMS suffers from an arbitrary file deletion vulnerability, which can be exploited by an attacker to delete arbitrary files...
novel-plus SQL注入漏洞
novel-plus novel boutique-plus is a multi-end PC, WAP reading, functional original literature CMS system. novel-plus version 3.6.2 suffers from a SQL injection vulnerability, which originates from a problem with the file /author/list?limit=10&offset=0&order=desc, where the operation of the...
MediaWiki authorization error vulnerability (CNVD-2023-29701)
MediaWiki is a free and free-to-use web-based wiki engine from the MediaWiki Foundation, which can be used to deploy in-house knowledge management and content management systems. An authorization error vulnerability exists in the MediaWiki GrowthExperiments extension, which could be exploited by ...
New Python-Based "Legion" Hacking Tool Emerges on Telegram
An emerging Python-based credential harvester and a hacking tool named Legion is being marketed via Telegram as a way for threat actors to break into various online services for further exploitation. Legion, according to Cado Labs, includes modules to enumerate vulnerable SMTP servers, conduct...
bloofoxCMS SQL注入漏洞
bloofoxCMS is a Php-based text content management system by the individual developer of bloofoxCMS. A security vulnerability exists in bloofoxCMS version v0.5.2, which originates from an SQL injection in component/index.php?mode=content&page=pages&action=edit&eid=1...
PT-2023-20991 · Unknown · Gdidees Cms
Name of the Vulnerable Software and Affected Versions: GDidees CMS versions 3.9.1 and lower Description: The issue is related to an arbitrary file download via the filename parameter at the "/ admin/imgdownload.php" API endpoint. This allows unauthorized access to files on the system...
CVE-2020-20913
SQL Injection vulnerability found in Ming-Soft MCMS v.4.7.2 allows a remote attacker to execute arbitrary code via basictitle parameter...
KiteCMS 代码问题漏洞
KiteCMS is a website CMS. A security vulnerability exists in KiteCMS v.1.1. An attacker can exploit this vulnerability to execute arbitrary code via the uploadFile function...
The vulnerability of the femanager extension of the TYPO3 content management system allows a hacker to remove arbitrary users.
The vulnerability of the femanager extension of the TYPO3 content management system is related to the lack of access control in the InvitationController function. Exploiting this vulnerability could allow a malicious actor to delete arbitrary users remotely...
Cross site scripting
Wagtail is an open source content management system built on Django. Starting in version 1.5 and prior to versions 4.1.4 and 4.2.2, a stored cross-site scripting XSS vulnerability exists on ModelAdmin views within the Wagtail admin interface. A user with a limited-permission editor account for th...
Input validation
Wagtail is an open source content management system built on Django. Prior to versions 4.1.4 and 4.2.2, a memory exhaustion bug exists in Wagtail's handling of uploaded images and documents. For both images and documents, files are loaded into memory during upload for additional processing. A use...
CVE-2022-38922
BluePage CMS thru 3.9 processes an insufficiently sanitized HTTP Header Cookie value allowing MySQL Injection in the 'users-cookie-settings' token using a Time-based blind SLEEP payload...
BluePage CMS SQL注入漏洞
BluePage CMS is a content management system from BluePage open source. A security vulnerability exists in BluePage CMS version 3.9 and earlier versions , the vulnerability stems from SQL injection when processing insufficiently cleaned HTTP headers...
CVE-2023-1797
A vulnerability classified as critical was found in OTCMS 6.0.1. Affected by this vulnerability is an unknown functionality of the file sysCheckFile.php?mudi=sql. The manipulation leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and m...
The vulnerability of the femanager extension of the TYPO3 content management system allows a hacker to set arbitrary passwords for users of the system.
The vulnerability of the femanager extension of the TYPO3 content management system is related to the lack of access control in the InvitationController. Exploiting this vulnerability allows a malicious actor to set arbitrary passwords for users of the system remotely...