150 matches found
CVE-2021-29368
Session fixation vulnerability in CuppaCMS thru commit 4c9b742b23b924cf4c1f943f48b278e06a17e297 on November 12, 2019 allows attackers to gain access to arbitrary user sessions...
Session fixation
Session fixation vulnerability in CuppaCMS thru commit 4c9b742b23b924cf4c1f943f48b278e06a17e297 on November 12, 2019 allows attackers to gain access to arbitrary user sessions...
CVE-2021-29368
Session fixation vulnerability in CuppaCMS thru commit 4c9b742b23b924cf4c1f943f48b278e06a17e297 on November 12, 2019 allows attackers to gain access to arbitrary user sessions...
CVE-2021-29368
CVE-2021-29368 affects CuppaCMS with a session fixation flaw that allows an attacker to access arbitrary user sessions. Affected are versions prior to the commit 4c9b742b23b924cf4c1f943f48b278e06a17e297 (Nov 12, 2019). Root cause is session handling that permits fixation, enabling unauthorized se...
CVE-2021-29368
Session fixation vulnerability in CuppaCMS thru commit 4c9b742b23b924cf4c1f943f48b278e06a17e297 on November 12, 2019 allows attackers to gain access to arbitrary user sessions...
PT-2023-12133 · Cuppacms · Cuppacms
Name of the Vulnerable Software and Affected Versions: CuppaCMS versions prior to commit 4c9b742b23b924cf4c1f943f48b278e06a17e297 Description: The issue allows attackers to gain access to arbitrary user sessions through a session fixation vulnerability. Recommendations: For versions prior to comm...
CuppaCMS 授权问题漏洞
CuppaCMS is a content management system CMS. A security vulnerability exists in CuppaCMS that stems from the presence of a session fixation vulnerability, which can be exploited by an attacker to access arbitrary user sessions...
CuppaCMS Remote Code Execution (CVE-2022-37190)
A remote code execution vulnerability exists in CuppaCMS. Successful exploitation of this vulnerability could allow a remote attacker to damage users system...
CVE-2022-37190
CuppaCMS 1.0 is vulnerable to Remote Code Execution RCE. An authenticated user can control both parameters action and function from "/api/index.php...
CVE-2022-37190
CuppaCMS 1.0 is vulnerable to Remote Code Execution RCE. An authenticated user can control both parameters action and function from "/api/index.php...
CVE-2022-37191
The component "cuppa/api/index.php" of CuppaCMS v1.0 is Vulnerable to LFI. An authenticated user can read system files via crafted POST request using function parameter value as LFI payload...
CVE-2022-37191
The component "cuppa/api/index.php" of CuppaCMS v1.0 is Vulnerable to LFI. An authenticated user can read system files via crafted POST request using function parameter value as LFI payload...
CVE-2022-37190
CuppaCMS 1.0 is vulnerable to Remote Code Execution RCE. An authenticated user can control both parameters action and function from "/api/index.php...
Cross site request forgery (csrf)
The component "cuppa/api/index.php" of CuppaCMS v1.0 is Vulnerable to LFI. An authenticated user can read system files via crafted POST request using function parameter value as LFI payload...
Remote code execution
CuppaCMS 1.0 is vulnerable to Remote Code Execution RCE. An authenticated user can control both parameters action and function from "/api/index.php...
CVE-2022-37191
The component "cuppa/api/index.php" of CuppaCMS v1.0 is Vulnerable to LFI. An authenticated user can read system files via crafted POST request using function parameter value as LFI payload...
CVE-2022-37191
CVE-2022-37191 affects CuppaCMS v1.0. The vulnerability is an authenticated Local File Inclusion in the cuppa/api/index.php component triggered by crafting a POST request whose function parameter is used as LFI payload, enabling an attacker with valid credentials to read system files. The Nuclei ...
CVE-2022-37190
CuppaCMS 1.0 is vulnerable to Remote Code Execution RCE. An authenticated user can control both parameters action and function from "/api/index.php...
CVE-2022-37190
CuppaCMS 1.0 is affected by a Remote Code Execution (RCE) vulnerability. An authenticated user can control both action and function parameters in the /api/index.php endpoint, enabling arbitrary code execution on the affected system. The NVD entry and the Nuclei template corroborate this RCE scena...