243 matches found
CVE-2023-30130
An issue found in CraftCMS v.3.8.1 allows a remote attacker to execute arbitrary code via a crafted script to the Section parameter...
CVE-2023-30130: Improper Control of Generation of Code
An issue found in CraftCMS v.3.8.1 allows a remote attacker to execute arbitrary code via a crafted script to the Section parameter...
CraftCMS 代码注入漏洞
CraftCMS is a CMS program. CraftCMS version v3.8.1 suffers from a code injection vulnerability that stems from the lack of effective filtering and escaping of user-supplied data by Section parameters, which can be exploited by an attacker to execute arbitrary Web script or HTML by injecting a...
CVE-2023-30130
Summary (CVE-2023-30130) CraftCMS v3.8.1 contains a code-injection vulnerability exploited by a crafted Script in the Section parameter. The issue arises from inadequate filtering/escaping of user-supplied data, enabling a remote attacker to execute arbitrary code. The CVSS 3.1 baseline indicates...
CVE-2023-30130
An issue found in CraftCMS v.3.8.1 allows a remote attacker to execute arbitrary code via a crafted script to the Section parameter...
CVE-2023-30130
An issue found in CraftCMS v.3.8.1 allows a remote attacker to execute arbitrary code via a crafted script to the Section parameter...
PT-2023-22550
Name of the Vulnerable Software and Affected Versions CraftCMS version 3.8.1 Description The issue allows a remote attacker to execute arbitrary code via a crafted script to the Section parameter. This enables the attacker to potentially gain control over the system, allowing for unauthorized...
Cross-Site Scripting (XSS)
craftcms/cms is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to a lack of user-input sanitization in Craft parameter of Asset.php which allows an attacker to inject and execute arbitrary JavaScript into the browser...
craftcms/cms vulnerable to cross site scripting in RSS feed widget
A malformed title in the feed widget of craftcms/cms can deliver an XSS payload. This has been resolved in this commit...
GHSA-J4MX-98HW-6RV6 craftcms/cms vulnerable to cross site scripting in RSS feed widget
A malformed title in the feed widget of craftcms/cms can deliver an XSS payload. This has been resolved in this commit...
CraftCMS Administration Panel Login Form Detected
CraftCMS Administration Panel has been detected on the target web application. This may present an attacker with an exploit vector which could be leveraged using other techniques, such as a Brute-Force or Dictionary Attack, allowing an attacker to gain access to administrative functionality. No...
CraftCMS User Enumeration
In default CraftCMS installation there is available methodology to enumerate user information. These CraftCMS users may then be used in brute-force attacks against CraftCMS login page to guess passwords. No source data...
CraftCMS DevMode Enabled
CraftCMS installed on the remote host is configured to operate in development mode devMode. While this environment can help speed up development of web applications, it can leak information about the underlying web applications. No source data...
GHSA-WV7J-RC2Q-9J67 Cross Site Scripting in CraftCMS
CraftCMS prior to version 3.7.68 is vulnerable Cross Site Scripting XSS. An attacker can inject javascript code into Volume Name...
Cross Site Scripting in CraftCMS
CraftCMS prior to version 3.7.68 is vulnerable Cross Site Scripting XSS. An attacker can inject javascript code into Volume Name...
CVE-2023-30177
CraftCMS 3.7.59 is vulnerable Cross Site Scripting XSS. An attacker can inject javascript code into Volume Name...
Cross site scripting
CraftCMS 3.7.59 is vulnerable Cross Site Scripting XSS. An attacker can inject javascript code into Volume Name...
CVE-2023-30177
CraftCMS 3.7.59 is vulnerable to Cross-Site Scripting (XSS) via the Volume Name. The root cause is an XSS flaw in CraftCMS that allows injected JavaScript. Affected version according to sources: 3.7.59; remediation is to upgrade to 3.7.68 or later (CraftCMS patch) to mitigate. If upgrading is not...