The vulnerability of the DIAFAN.CMS content management system lies in the lack of protective measures for the SQL query structure, allowing attackers to execute arbitrary code.

The vulnerability of the DIAFAN.CMS website content management system is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the Webasyst content management framework and the Shop-Script CMS system lies in the lack of measures to protect the SQL query structure, allowing attackers to execute arbitrary SQL code.

The vulnerability of the Webasyst framework for designing content management systems and the Shop-Script CMS system lies in the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL code remotely...

CMSeeK

What is a CMS? A content management system CMS manages the creation and modification of digital content. It typically supports multiple users in a collaborative environment. Some noteable examples are: WordPress, Joomla, Drupal etc. Release History root@kitploit:...

petereport

PeTeReport PeTeReport（渗 透测 试报告 ）是一个开源的应用漏洞报告工具，旨在协助渗透测试/红队工作，通过简化报告的编写与生成任务。 专注于产品安全，该工具帮助安全研究员和渗透测试人员提供详细的发现项、附录、攻击路径，并管理一个发现项模板数据库，以避免在报告阶段浪费时间。 PeTeReport（渗 透测 试报告 ）使用 Django 和 Python 3 编写，旨在帮助渗透测试人员和安全研究员管理发现项仓库、编写报告（使用 Markdown）并以不同格式（HTML、CSV、PDF、Jupyter 和 Markdown）生成报告。 渗透测试内容管理与报告工具 文档 文档...

Masa CMS - Authentication Bypass

Masa CMS 7.2, 7.3, and 7.4-beta are susceptible to authentication bypass in the Remember Me function. An attacker can bypass authentication via a crafted web request and thereby obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the...

PrestaHome Blog for PrestaShop <1.7.8 - SQL Injection

PrestaHome Blog for PrestaShop prior to version 1.7.8 is vulnerable to a SQL injection blind via the sbcategory parameter. id: CVE-2021-36748 info: name: PrestaHome Blog for PrestaShop 1.7.8 - SQL Injection author: whoever severity: high description: PrestaHome Blog for PrestaShop prior to versio...

u5cms v8.3.5 - Open Redirect

u5cms version 8.3.5 contains a URL redirection vulnerability that can cause a user's browser to be redirected to another site via /loginsave.php. id: CVE-2022-32444 info: name: u5cms v8.3.5 - Open Redirect author: 0xAkoko severity: medium description: | u5cms version 8.3.5 contains a URL...

Backdrop CMS version 1.23.0 - Cross Site Scripting (Stored)

Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting XSS vulnerability via the Page content. id: CVE-2022-42095 info: name: Backdrop CMS version 1.23.0 - Cross Site Scripting Stored author: theamanrawat severity: medium description: | Backdrop CMS version 1.23.0 was...

cve-2023-41564-research

CVE-2023-41564 漏洞概要 CVE-2023-415641 是 Cockpit CMS（module'assets'-extend // 省略 'upload' = functionstring|array $param = 'files', array $meta = , bool $isUpload = true $files = ; if isstring$param && isset$this-app-request-files$param $...

pywhatcms

PyWhatCMS Python package for whatcms.com API The package provides a simple way to use the whatcms.org API for detecting 467 different Content Management Systems CMS Installation root@kitploit: pip install pywhatcms Usage First of all, import pywhatcms: root@kitploit: from pywhatcms import whatcms...

CVE-2023-23752

CVE-2023-23752 Joomla 未授权访问漏洞 CVE-2023-23752 漏洞描述 Joomla是一款开源的内容管理系统（CMS），使用PHP编写，支持MySQL、MSSQL和PostgreSQL等多种数据库系统。访问限制不当导致未经授权访问服务器REST API接口。 受影响版本：Joomla 4.0.0 - 4.2.7 使用帮助 root@kitploit: optional arguments: -h, --help show this help message and exit -u URL, --url URL 指定url地址 -f FILE, --file...

CVE-2026-6182-SQLI-auth

Bypass de Autenticación por Inyección SQL - Sistema de Gestión de Contenidos Simple en PHP Descripción Existe una vulnerabilidad de Inyección SQL en la página de inicio de sesión de administrador de Simple Content Management System PHP. El parámetro user no se sanea antes de pasarse a la consulta...

CVE-2026-6184-stored-XSS

XSS Almacenado en el Título de Noticias - Sistema de Gestión de Contenidos Simple PHP Descripción Existe una vulnerabilidad de Cross-Site Scripting XSS Almacenado en el Sistema de Gestión de Contenidos Simple PHP. El campo Título de Noticias en el panel de administración no sanitiza la entrada de...

CMS_Detector

CMSDetector Python2 Donación : BTC : 31mtLHqhaXXyCMnT2EU73U8fwYwigiEEU1 Perfect Money : U22270614...

EUVD-2026-54577

Kirby: System path exposure from error messages in the REST API...

The vulnerability of the DIAFAN.CMS content management system lies in the lack of protective measures for the SQL query structure, allowing attackers to execute arbitrary code.

The vulnerability of the DIAFAN.CMS website content management system is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2026-54721

Silverstripe UserForms provides a visual form builder for the Silverstripe CMS. From 6.0.0 until 6.4.9, 7.0.7, and 7.1.1, the userform email recipient subject field in the CMS accepts a specially crafted payload that can be interpreted as executable server-side code. An authenticated CMS user wit...

UBUNTU-CVE-2026-39275

Cross Site Scripting vulnerability in Cockpit CMS v.2.13.5 and before allows a remote attacker to execute arbitrary code via the item.php, field-select.js and tags.js components...

CVE-2026-39275

Cross Site Scripting vulnerability in Cockpit CMS v.2.13.5 and before allows a remote attacker to execute arbitrary code via the item.php, field-select.js and tags.js components...

Astra Linux – Vulnerability in Wireshark

A crash in the CMS protocol dissector in Wireshark versions 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows for denial of service through packet injection or malicious capture files...