96 matches found
Default credentials
DoraCMS v2.1.8 was discovered to re-use the same code for verification of valid usernames and passwords. This vulnerability allows attackers to gain access to the application via a bruteforce attack...
Privilege escalation
An arbitrary file upload vulnerability in DoraCMS v2.1.8 allow attackers to execute arbitrary code via uploading a crafted HTML or image file to the user avatar...
PT-2023-31228 · Doracms · Doracms
Name of the Vulnerable Software and Affected Versions: DoraCMS version 2.1.8 Description: The issue allows attackers to gain access to the application via a bruteforce attack due to the re-use of the same code for verification of valid usernames and passwords. Recommendations: For DoraCMS version...
CVE-2023-49444
An arbitrary file upload vulnerability in DoraCMS v2.1.8 allow attackers to execute arbitrary code via uploading a crafted HTML or image file to the user avatar...
CVE-2023-49443
DoraCMS v2.1.8 was discovered to re-use the same code for verification of valid usernames and passwords. This vulnerability allows attackers to gain access to the application via a bruteforce attack...
DoraCMS Security Vulnerability
DoraCMS is a software application. A content management system written on Nodejs + eggjs + mongodb. A security vulnerability exists in DoraCMS version v2.1.8, which originates from reusing the same code to validate a valid username and password. An attacker could exploit the vulnerability to gain...
DoraCMS 安全漏洞
DoraCMS is a software application. Based on Nodejs+eggjs+mongodb to write a content management system . A cross-site scripting XSS vulnerability exists in DoraCMS version v2.1.8. An attacker can exploit this vulnerability to execute arbitrary code by uploading a specially crafted HTML or image fi...
CVE-2023-49444
CVE-2023-49444 affects DoraCMS v2.1.8. An arbitrary file upload vulnerability exists that allows code execution when a crafted HTML or image file is uploaded to a user avatar. The public description attributes the flaw to a file-upload weakness but does not provide detailed root-cause or affected...
CVE-2023-49443
CVE-2023-49443 affects DoraCMS v2.1.8. The root cause is re-use of the same code to verify usernames and passwords, enabling brute-force access to the application. Documents describe impact as attacker access via brute force over the network (no user interaction). Mitigation in the sources includ...
CVE-2022-35147
DoraCMS v2.18 and earlier allows attackers to bypass login authentication via a crafted HTTP request...
CVE-2022-35147
DoraCMS v2.18 and earlier allows attackers to bypass login authentication via a crafted HTTP request...
CVE-2022-35147
DoraCMS v2.18 and earlier allows attackers to bypass login authentication via a crafted HTTP request...
Cross site request forgery (csrf)
DoraCMS v2.18 and earlier allows attackers to bypass login authentication via a crafted HTTP request...
CVE-2022-35147
DoraCMS v2.18 and earlier allows attackers to bypass login authentication via a crafted HTTP request...
CVE-2022-35147
DoraCMS v2.18 and earlier has an authentication bypass vulnerability (CVE-2022-35147). The issue allows an attacker to bypass login via a crafted HTTP request, enabling unauthorized access. Affected software is DoraCMS, versions up to 2.18; root cause involves bypassing authentication logic. Impa...
PT-2022-22599 · Doracms · Doracms
Name of the Vulnerable Software and Affected Versions: DoraCMS versions 2.18 and earlier Description: The issue allows attackers to bypass login authentication via a crafted HTTP request. This enables unauthorized access without proper credentials. Recommendations: For DoraCMS versions 2.18 and...
DoraCMS 信息泄露漏洞
DoraCMS is a software application. A content management system written on Nodejs + eggjs + mongodb. An information disclosure vulnerability exists in DoraCMS v2.18 and earlier versions, which stems from the fact that an attacker can bypass login authentication via a carefully crafted HTTP request...
CVE-2022-25464
A stored cross-site scripting XSS vulnerability in the component /admin/contenttemp of DoraCMS v2.1.8 allows attackers to execute arbitrary web scripts or HTML via a crafted payload...