8536 matches found
CVE-2022-23899
MCMS v5.2.5 was discovered to contain a SQL injection vulnerability via search.do in the file /web/MCmsAction.java...
CVE-2022-23899
MCMS v5.2.5 was discovered to contain a SQL injection vulnerability via search.do in the file /web/MCmsAction.java...
Taocms id parameter SQL injection vulnerability
Taocms is a micro Cms content management system in China. version 3.0.2 of Taocms is vulnerable to SQL injection, which stems from the lack of validation of externally entered SQL statements by the backend parameter id. An attacker can use this vulnerability to execute illegal SQL commands to ste...
MaxSite CMS Cross-Site Scripting Vulnerability (CNVD-2022-33826) (CVE-2022-25413)
MaxSite CMS is a web content management system of the Russian MaxSite CMS open source project.MaxSite CMS 108 has a cross-site scripting vulnerability that can be exploited by attackers to perform cross-site scripting attacks via the ftags parameter in /admin/pageedit/3...
PluXml Cross-Site Scripting Vulnerability (CNVD-2022-73493)
PluXml is a content management system that does not require a database to work.A cross-site scripting vulnerability exists in PluXML version 5.8.7. An attacker can exploit this vulnerability to execute arbitrary web script or HTML via a payload in the thumbnail path of a blog post...
Metalgenix GeniXCMS 跨站脚本漏洞
Metalgenix GeniXCMS is a PHP-based content management system and framework CMSF from MetalGenix Metalgenix Indonesia. The system provides modules for user management, content management and menu management. A security vulnerability exists in Metalgenix GeniXCMS v1.1.11, which can be exploited by...
Maxsite CMS arbitrary file deletion vulnerability
MaxSite CMS is a web content management system of the Russian MaxSite CMS open source project . Maxsite CMS has arbitrary file deletion vulnerability , the vulnerability stems from all-files-update-ajax.php in the dir and deletefile parameters for the file name lack of validation , the attacker c...
MODX Revolution code issue vulnerability
MODX Revolution is a PHP-based open source content management system CMS from the US company MODX. The system supports online collaboration, search engine optimization SEO, etc. MODX Revolution has a code issue vulnerability that can be exploited by attackers to execute arbitrary code by uploadin...
CVE-2022-23907
CMS Made Simple v2.2.15 was discovered to contain a reflected cross-site scripting XSS vulnerability via the parameter m1fmmessage...
CVE-2022-25412
Maxsite CMS v180 was discovered to contain multiple arbitrary file deletion vulnerabilities in /adminpage/all-files-update-ajax.php via the dir and deletefile parameters...
BloofoxCms Cross-Site Scripting Vulnerability (CNVD-2022-17027)
BloofoxCms is a Php-based text content management system from alexlang24 personal developer. bloofoxCMS suffers from a cross-site scripting vulnerability that stems from the lack of user-supplied data and output data validation filtering in the file and type parameters in index.php. An attacker...
CMS Made Simple 代码问题漏洞
CMS Made Simple CMSMS is an open source content management system CMS from the CMSMS Cmsms team. The system supports role-based permission management system, wizard-based installation and update mechanism, intelligent caching mechanism and so on. CMS Made Simple suffers from a code issue...
Strapi 安全漏洞
Strapi is an open source headless content management system CMS. Strapi is vulnerable to an operating system command injection vulnerability that originates from arbitrary command injection in the GitHub repository. No detailed vulnerability details are currently available...
ROS-20220225-02
Vulnerability in the Drupal content management system, related to incorrect access restrictions in the in the quick edit module. Exploitation of the vulnerability could allow an attacker acting remotely, to view content restricted by other means A vulnerability in Drupal's content management...
Exploit for Cross-site Scripting in Intelliants Subrion_Cms
Subrion CMS 4.2.1 – Reflected XSS vulnerability in Kickstart t...
CVE-2022-25101
A vulnerability in the component /templates/install.php of WBCE CMS v1.5.2 allows attackers to execute arbitrary code via a crafted PHP file...
CVE-2022-23810
Template injection Improper Neutralization of Special Elements Used in a Template Engine vulnerability in a-blog cms Ver.2.8.x series versions prior to Ver.2.8.75, Ver.2.9.x series versions prior to Ver.2.9.40, Ver.2.10.x series versions prior to Ver.2.10.44, Ver.2.11.x series versions prior to...
CVE-2022-21142
Authentication bypass vulnerability in a-blog cms Ver.2.8.x series versions prior to Ver.2.8.74, Ver.2.9.x series versions prior to Ver.2.9.39, Ver.2.10.x series versions prior to Ver.2.10.43, and Ver.2.11.x series versions prior to Ver.2.11.41 allows a remote unauthenticated attacker to bypass...