CVE-2019-7168

CVE-2019-7168 is a stored-self XSS in Croogo CMS prior to or at version 3.0.5, enabling an attacker to execute HTML or JavaScript via the Blog field at /admin/nodes/nodes/add/blog. The Red Hat/EUVD/OSV entries and GitHub advisories corroborate a Croogo-based XSS issue with Croogo 3.0.5. The avail...

CVE-2019-7171

A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /admin/blocks/blocks/edit/8...

CVE-2019-7169

Croogo 3.0.5 and earlier are affected by a stored self‑XSS in the Title field of the Main Menu edit page (/admin/menus/menus/edit/3). The underlying issue allows an attacker to inject HTML/JavaScript into the vulnerable Title field, which gets stored and can be executed when viewed by other users...

CVE-2019-7173

Croogo is affected by a stored-self XSS vulnerability in the title field of the Attachment page (/admin/file-manager/attachments/edit/4). Affected versions include Croogo prior to 3.0.7 (v3.0.5 referenced; OSV notes vulnerability before 3.0.7). The root cause is reflected in multiple sources desc...

CVE-2019-7173

A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /admin/file-manager/attachments/edit/4...

Croogo Cross-Site Scripting Vulnerability

Croogo is a content management system CMS based on the CakePHP framework development . The system provides content type can be customized for Blog, Node, Page, content editing using WYSIWYG editor and other features. A cross-site scripting vulnerability exists in Page name in Croogo version...

Cross site scripting

Croogo version 2.3.1-17-g6f82e6c contains a Cross Site Scripting XSS vulnerability in Page name that can result in execution of javascript code...

CVE-2017-1000510

Croogo version 2.3.1-17-g6f82e6c contains a Cross Site Scripting XSS vulnerability in Page name that can result in execution of javascript code...

CVE-2017-1000510

Croogo version 2.3.1-17-g6f82e6c contains a Cross Site Scripting XSS vulnerability in Page name that can result in execution of javascript code...

CVE-2017-1000510

Affected software : Croogo 2.3.1-17-g6f82e6c (Croogo CMS). Vulnerability : Cross-Site Scripting (XSS) in the Page name field. Root cause / scope : The vulnerability exists in the Page name handling within Croogo, enabling execution of JavaScript code in affected pages. The CVE description specifi...

CVE-2017-1000510

Croogo version 2.3.1-17-g6f82e6c contains a Cross Site Scripting XSS vulnerability in Page name that can result in execution of javascript code...

Stored Cross-Site Scripting (XSS)

croogo is vulnerable to cross-site scripting XSS attacks. If a malicious administrator of a post includes webscript within the name of a page, it will be executed within the browser when displayed in the admin panel page list...

Cross-site Scripting (XSS)

Croogo is vulnerable to cross-site scripting XSS attacks. A malicious user can inject and execute arbitrary web script by passing a malicious link through the administrative backend...

CVE-2015-1053

Cross-site scripting XSS vulnerability in the administrative backend in Croogo before 2.2.1 allows remote attackers to inject arbitrary web script or HTML via the path parameter to admin/filemanager/filemanager/editfile...

Cross site scripting

Cross-site scripting XSS vulnerability in the administrative backend in Croogo before 2.2.1 allows remote attackers to inject arbitrary web script or HTML via the path parameter to admin/filemanager/filemanager/editfile...

CVE-2015-1053

The CVE-2015-1053 entry relates to Croogo’s administrative backend, where an XSS flaw exists in versions prior to 2.2.1. The vulnerability arises from the path parameter used by admin/file_manager/file_manager/editfile, enabling remote attackers to inject arbitrary web script or HTML. Reports acr...

CVE-2015-1053

Cross-site scripting XSS vulnerability in the administrative backend in Croogo before 2.2.1 allows remote attackers to inject arbitrary web script or HTML via the path parameter to admin/filemanager/filemanager/editfile...

Croogo CMS Cross-Site Scripting Vulnerability

Croogo CMS is a content management system. Croogo CMS suffers from a cross-site scripting vulnerability that can be exploited by remote attackers to construct malicious URIs and trick users into parsing them, which can be used to obtain sensitive cookies, hijack sessions, or perform malicious...

CMS Croogo 2.2.0 Cross Site Scripting

Advisory: Reflecting XSS vulnerability in CMS Croogo v.2.2.0 Advisory ID: SROEADV-2015-02 Author: Steffen Rösemann Affected Software: CMS Croogo v.2.20 Vendor URL: https://croogo.org Vendor Status: solved CVE-ID: - ========================== Vulnerability Description: ========================== T...

Croogo 2.0.0 - Arbitrary PHP Code Execution Exploit

No description provided by source. !/usr/bin/env python Croogo 2.0.0 Arbitrary PHP Code Execution Exploit Vendor: Fahad Ibnay Heylaal Product web page: http://www.croogo.org Affected version: 2.0.0 Summary: Croogo is a free, open source, content management system for PHP, released under The MIT...