47 matches found
CVE-2019-8440
An issue was discovered in DiliCMS 2.4.0. There is a Stored XSS Vulnerability in the third textbox aka site logo of "System setting-site setting" of admin/index.php, aka sitelogo...
CVE-2019-8439
An issue was discovered in DiliCMS 2.4.0. There is a Stored XSS Vulnerability in the second textbox of "System setting-site setting" of admin/index.php, aka sitedomain...
CVE-2019-8439
DiliCMS 2.4.0 has a Stored XSS vulnerability in the site_domain field (second textbox) under System setting -> site setting in admin/index.php. CNVD-2019-07939 notes this allows a remote attacker to inject arbitrary script/HTML; the CMS is described as based on CodeIgniter. No exploit specific...
CVE-2019-8438
CVE-2019-8438 affects DiliCMS 2.4.0. A Stored XSS vulnerability exists in the first textbox of System setting -> site setting (admin/index.php), specifically the site_name field. The issue is described without exploit details in the provided sources; CVSS scores from NVD indicate a Low to Medi...
CVE-2018-19291
An issue was discovered in DiliCMS 2.4.0. There is a CSRF vulnerability that can delete a user or group via an admin/index.php/user/del/1 or admin/index.php/role/del/2 URI...
Cross site request forgery (csrf)
An issue was discovered in DiliCMS 2.4.0. There is a CSRF vulnerability that can delete a user or group via an admin/index.php/user/del/1 or admin/index.php/role/del/2 URI...
CVE-2018-19291
An issue was discovered in DiliCMS 2.4.0. There is a CSRF vulnerability that can delete a user or group via an admin/index.php/user/del/1 or admin/index.php/role/del/2 URI...
CVE-2018-19291
DiliCMS 2.4.0 contains a CSRF vulnerability that can delete a user or group via admin/index.php/user/del/1 or admin/index.php/role/del/2. This has been documented across multiple sources (e.g., NVD, CVE records). The underlying issue is a cross-site request forgery that allows unauthorized action...
CVE-2018-19291
An issue was discovered in DiliCMS 2.4.0. There is a CSRF vulnerability that can delete a user or group via an admin/index.php/user/del/1 or admin/index.php/role/del/2 URI...
DiliCMS Cross-Site Request Forgery Vulnerability
DiliCMS is a rapid development content management system based on CodeIgniter. DiliCMS 2.4.0 suffers from a cross-site request forgery vulnerability that can be exploited by an attacker to delete a user or group via the admin/index.php/user/del/1 or admin/index.php/role/del/2 URIs...
DiliCMS Cross-Site Scripting Vulnerability (CNVD-2019-17479)
DiliCMS is a rapid development content management system based on CodeIgniter. DiliCMS has a cross-site scripting vulnerability that can be exploited to inject web code and obtain sensitive information via the attachmenttype parameter of admin/index.php/setting/site?tab=siteattachment...
CVE-2018-18209
XSS exists in DiliCMS 2.4.0 via the admin/index.php/setting/site?tab=siteattachment attachmenttype parameter...
CVE-2018-18210
XSS exists in DiliCMS 2.4.0 via the admin/index.php/setting/site?tab=siteattachment attachmenturl parameter...
CVE-2018-18210
XSS exists in DiliCMS 2.4.0 via the admin/index.php/setting/site?tab=siteattachment attachmenturl parameter...
CVE-2018-18209
XSS exists in DiliCMS 2.4.0 via the admin/index.php/setting/site?tab=siteattachment attachmenttype parameter...
Cross site scripting
XSS exists in DiliCMS 2.4.0 via the admin/index.php/setting/site?tab=siteattachment attachmenturl parameter...
Cross site scripting
XSS exists in DiliCMS 2.4.0 via the admin/index.php/setting/site?tab=siteattachment attachmenttype parameter...
CVE-2018-18210
CVE-2018-18210 shows a Cross-Site Scripting (XSS) vulnerability in DiliCMS 2.4.0 exploited via the attachment_url parameter of admin/index.php/setting/site?tab=site_attachment. Multiple databases describe XSS that can be used to inject scripts and potentially access sensitive information. Exploit...