CVE-2023-22729 Silverstripe Framework has open redirect vulnerability on CMSSecurity relogin screen

Silverstripe Framework is the Model-View-Controller framework that powers the Silverstripe content management system. Prior to version 4.12.15, an attacker can display a link to a third party website on a login screen by convincing a legitimate content author to follow a specially crafted link...

CVE-2023-22729 Silverstripe Framework has open redirect vulnerability on CMSSecurity relogin screen

Silverstripe Framework is the Model-View-Controller framework that powers the Silverstripe content management system. Prior to version 4.12.15, an attacker can display a link to a third party website on a login screen by convincing a legitimate content author to follow a specially crafted link...

CVE-2023-22728 Silverstripe Framework has missing permission check of canView in GridFieldPrintButton

Silverstripe Framework is the Model-View-Controller framework that powers the Silverstripe content management system. Prior to version 4.12.15, the GridField print view incorrectly validates the permission of DataObjects potentially allowing a content author to view records they are not authorise...

CVE-2023-22728

CVE-2023-22728 affects Silverstripe Framework specifically the GridField print view. The root cause is a missing/incorrect permission check for DataObjects in GridFieldPrintButton, potentially allowing a content author to view records they are not authorized to access. Affected software: Silverst...

CVE-2023-22728 Silverstripe Framework has missing permission check of canView in GridFieldPrintButton

Silverstripe Framework is the Model-View-Controller framework that powers the Silverstripe content management system. Prior to version 4.12.15, the GridField print view incorrectly validates the permission of DataObjects potentially allowing a content author to view records they are not authorise...

UCMS 跨站脚本漏洞

UCMS is a content management system written in PHP. A cross-site scripting vulnerability exists in UCMS version 1.6.0, which stems from a problem with the file saddpost.php, where incorrect manipulation of the parameter strorder can lead to cross-site scripting...

CLTPHP 代码问题漏洞

CLTPHP is an open source PHP content management system for efficient website building. A security vulnerability exists in CLTPHP version 6.0 and earlier versions, which stems from the presence of a file upload vulnerability...

CLTPHP 输入验证错误漏洞

CLTPHP is an open source and efficient site-building PHP content management system. An input validation error vulnerability exists in CLTPHP version 6.0 and earlier versions, which stems from incorrect input validation in application/admin/controller/Template.php. An attacker can exploit this...

CVE-2023-29200

Summary: CVE-2023-29200 is a directory traversal vulnerability in Contao’s file manager (core-bundle). Prior to versions 4.9.40, 4.13.21, and 5.1.4, authenticated back-end users could trigger an Ajax request to list arbitrary files outside the document root. Some sources state that file contents ...

Pixel＆tonic Craft CMS 跨站脚本漏洞

Pixel & tonic Craft CMS is a content management system CMS from Pixel & tonic USA. A security vulnerability exists in Pixel & tonic Craft CMS version 3.7.59. An attacker exploited the vulnerability to inject javascript code into Volume Name...

Backdrop CMS 跨站脚本漏洞

Backdrop CMS is an open source content management system CMS. A security vulnerability exists in Backdrop CMS versions prior to 1.24.2. An attacker can exploit this vulnerability to inject arbitrary web script or html code via the name parameter...

CVE-2023-29774

Dreamer CMS 3.0.1 is vulnerable to stored Cross Site Scripting XSS...

Desdev DedeCMS SQL注入漏洞

Desdev DedeCMS Dream Weaving Content Management System is a PHP-based open-source content management system CMS of China Zhuozhuo network Desdev company. The system has the functions of content publishing, content management, content editing and content retrieval. A security vulnerability exists ...

PT-2023-14177 · Unknown · Dreamer Cms

Name of the Vulnerable Software and Affected Versions: Dreamer CMS version 4.0.1 Description: The issue allows SQL injection via ArchivesMapper.xml. Recommendations: For Dreamer CMS version 4.0.1, consider restricting access to ArchivesMapper.xml to minimize the risk of exploitation. As a tempora...

SIYUCMS suffers from an arbitrary file deletion vulnerability (CNVD-2023-50754)

SIYUCMS is a content management system based on the latest version of ThinkPHP-5.1.X framework with AdminLTE in the backend front-end framework. SIYUCMS suffers from an arbitrary file deletion vulnerability, which can be exploited by an attacker to delete arbitrary files...

MediaWiki authorization error vulnerability (CNVD-2023-29701)

MediaWiki is a free and free-to-use web-based wiki engine from the MediaWiki Foundation, which can be used to deploy in-house knowledge management and content management systems. An authorization error vulnerability exists in the MediaWiki GrowthExperiments extension, which could be exploited by ...

novel-plus SQL注入漏洞

novel-plus novel boutique-plus is a multi-end PC, WAP reading, functional original literature CMS system. novel-plus version 3.6.2 suffers from a SQL injection vulnerability, which originates from a problem with the file /author/list?limit=10&offset=0&order=desc, where the operation of the...

New Python-Based "Legion" Hacking Tool Emerges on Telegram

An emerging Python-based credential harvester and a hacking tool named Legion is being marketed via Telegram as a way for threat actors to break into various online services for further exploitation. Legion, according to Cado Labs, includes modules to enumerate vulnerable SMTP servers, conduct...

bloofoxCMS SQL注入漏洞

bloofoxCMS is a Php-based text content management system by the individual developer of bloofoxCMS. A security vulnerability exists in bloofoxCMS version v0.5.2, which originates from an SQL injection in component/index.php?mode=content&page=pages&action=edit&eid=1...

PT-2023-20991 · Unknown · Gdidees Cms

Name of the Vulnerable Software and Affected Versions: GDidees CMS versions 3.9.1 and lower Description: The issue is related to an arbitrary file download via the filename parameter at the "/ admin/imgdownload.php" API endpoint. This allows unauthorized access to files on the system...