96 matches found
CVE-2018-16622
Multiple cross-site scripting XSS vulnerabilities in /api/content/addOne in DoraCMS v2.0.3 allow remote attackers to inject arbitrary web script or HTML via the 1 discription or 2 comments field, related to users/userAddContent...
CVE-2024-28715
Cross Site Scripting vulnerability in DOraCMS v.2.18 and before allows a remote attacker to execute arbitrary code via the markdown0 function in the /app/public/apidoc/oas3/wrap-components/markdown.jsx endpoint...
CVE-2024-28715
Cross Site Scripting vulnerability in DOraCMS v.2.18 and before allows a remote attacker to execute arbitrary code via the markdown0 function in the /app/public/apidoc/oas3/wrap-components/markdown.jsx endpoint...
DoraCMS Security Vulnerability
DoraCMS is a software application. A content management system written based on Nodejs + eggjs + mongodb. A security vulnerability exists in DoraCMS v.2.1.8 and earlier versions, which stems from a cross-site scripting vulnerability that allows remote attackers to execute arbitrary code via the...
PT-2024-22535 · Doracms · Doracms
Name of the Vulnerable Software and Affected Versions: DOraCMS versions 2.18 and earlier Description: A Cross Site Scripting issue allows a remote attacker to execute arbitrary code via the markdown0 function in the "/app/public/apidoc/oas3/wrap-components/markdown.jsx" endpoint. Recommendations:...
CVE-2024-28715
CVE-2024-28715 affects DoraCMS v2.18 and earlier. A cross-site scripting issue in the markdown0 function of /app/public/apidoc/oas3/wrap-components/markdown.jsx allows remote attackers to execute arbitrary code. Multiple connected sources confirm this, including Red Hat and PT Security. Mitigatio...
CVE-2023-51840
DoraCMS 2.1.8 is vulnerable to Use of Hard-coded Cryptographic Key...
CVE-2023-51840
DoraCMS 2.1.8 is vulnerable to Use of Hard-coded Cryptographic Key...
Hardcoded credentials
DoraCMS 2.1.8 is vulnerable to Use of Hard-coded Cryptographic Key...
CVE-2023-51840
DoraCMS 2.1.8 is vulnerable to Use of Hard-coded Cryptographic Key...
CVE-2023-51840
Affected software: DoraCMS 2.1.8 (Node.js stack with Egg.js and MongoDB, per CNNVD/CVE context). Vulnerability: Use of a hard-coded cryptographic key, leading to exposure of sensitive data and potential tampering. Root cause (as stated): Hard-coded cryptographic key within DoraCMS 2.1.8. Impact (...
DoraCMS Security Vulnerability
DoraCMS is a software application. A content management system written on Nodejs + eggjs + mongodb. A security vulnerability exists in DoraCMS version 2.1.8, which stems from the use of hard-coded encryption keys...
CVE-2023-51840
DoraCMS 2.1.8 is vulnerable to Use of Hard-coded Cryptographic Key...
DoraCMS Cross-Site Scripting Vulnerability (CNVD-2023-9750397)
DoraCMS is a software application. Based on Nodejs+eggjs+mongodb to write a content management system . A cross-site scripting XSS vulnerability exists in DoraCMS version v2.1.8. An attacker can exploit this vulnerability to execute arbitrary code by uploading a specially crafted HTML or image fi...
CVE-2023-49444
An arbitrary file upload vulnerability in DoraCMS v2.1.8 allow attackers to execute arbitrary code via uploading a crafted HTML or image file to the user avatar...
CVE-2023-49444
An arbitrary file upload vulnerability in DoraCMS v2.1.8 allow attackers to execute arbitrary code via uploading a crafted HTML or image file to the user avatar...
CVE-2023-49444
An arbitrary file upload vulnerability in DoraCMS v2.1.8 allow attackers to execute arbitrary code via uploading a crafted HTML or image file to the user avatar...
CVE-2023-49443
DoraCMS v2.1.8 was discovered to re-use the same code for verification of valid usernames and passwords. This vulnerability allows attackers to gain access to the application via a bruteforce attack...
CVE-2023-49443
DoraCMS v2.1.8 was discovered to re-use the same code for verification of valid usernames and passwords. This vulnerability allows attackers to gain access to the application via a bruteforce attack...