115 matches found
CVE-2024-28715
Cross Site Scripting vulnerability in DOraCMS v.2.18 and before allows a remote attacker to execute arbitrary code via the markdown0 function in the /app/public/apidoc/oas3/wrap-components/markdown.jsx endpoint...
CVE-2023-51840
DoraCMS 2.1.8 is vulnerable to Use of Hard-coded Cryptographic Key...
CVE-2023-49444
An arbitrary file upload vulnerability in DoraCMS v2.1.8 allow attackers to execute arbitrary code via uploading a crafted HTML or image file to the user avatar...
CVE-2022-25464
A stored cross-site scripting XSS vulnerability in the component /admin/contenttemp of DoraCMS v2.1.8 allows attackers to execute arbitrary web scripts or HTML via a crafted payload...
CVE-2020-18220
Weak Encoding for Password in DoraCMS v2.1.1 and earlier allows attackers to obtain sensitive information as it does not use a random salt or IV for its AES-CBC encryption, causes password encrypted for users to be susceptible to dictionary attacks...
CVE-2018-16622
Multiple cross-site scripting XSS vulnerabilities in /api/content/addOne in DoraCMS v2.0.3 allow remote attackers to inject arbitrary web script or HTML via the 1 discription or 2 comments field, related to users/userAddContent...
CVE-2024-28715
A DOM-based Cross-Site Scripting (XSS) vulnerability exists in DOraCMS v.2.18 and before . A remote attacker can execute arbitrary code by exploiting the markdown0 function within the —/app/public/apidoc/oas3/wrap-components/markdown.jsx—endpoint. Exploitation can be achieved via a URL like ‘http...
CVE-2024-28715: Improper Neutralization of Input During Web Page Generation
Cross Site Scripting vulnerability in DOraCMS v.2.18 and before allows a remote attacker to execute arbitrary code via the markdown0 function in the /app/public/apidoc/oas3/wrap-components/markdown.jsx endpoint...
DoraCMS Security Vulnerability
DoraCMS is a software application. A content management system written based on Nodejs + eggjs + mongodb. A security vulnerability exists in DoraCMS v.2.1.8 and earlier versions, which stems from a cross-site scripting vulnerability that allows remote attackers to execute arbitrary code via the...
CVE-2024-28715
Cross Site Scripting vulnerability in DOraCMS v.2.18 and before allows a remote attacker to execute arbitrary code via the markdown0 function in the /app/public/apidoc/oas3/wrap-components/markdown.jsx endpoint...
PT-2024-22535 · Doracms · Doracms
Name of the Vulnerable Software and Affected Versions: DOraCMS versions 2.18 and earlier Description: A Cross Site Scripting issue allows a remote attacker to execute arbitrary code via the markdown0 function in the "/app/public/apidoc/oas3/wrap-components/markdown.jsx" endpoint. Recommendations:...
CVE-2024-28715
Cross Site Scripting vulnerability in DOraCMS v.2.18 and before allows a remote attacker to execute arbitrary code via the markdown0 function in the /app/public/apidoc/oas3/wrap-components/markdown.jsx endpoint...
CVE-2023-51840
DoraCMS 2.1.8 is vulnerable to Use of Hard-coded Cryptographic Key...
CVE-2023-51840
DoraCMS 2.1.8 is vulnerable to Use of Hard-coded Cryptographic Key...
Hardcoded credentials
DoraCMS 2.1.8 is vulnerable to Use of Hard-coded Cryptographic Key...
CVE-2023-51840
DoraCMS 2.1.8 is vulnerable to Use of Hard-coded Cryptographic Key...
CVE-2023-51840: Use of Hard-coded Credentials
DoraCMS 2.1.8 is vulnerable to Use of Hard-coded Cryptographic Key...
DoraCMS Security Vulnerability
DoraCMS is a software application. A content management system written on Nodejs + eggjs + mongodb. A security vulnerability exists in DoraCMS version 2.1.8, which stems from the use of hard-coded encryption keys...
