136 matches found
CVE-2018-16773
EasyCMS 1.5 allows XSS via the index.php?s=/admin/fields/update/navTabId/listfields/callbackType/closeCurrent content field...
Cross site scripting
EasyCMS 1.5 allows XSS via the index.php?s=/admin/fields/update/navTabId/listfields/callbackType/closeCurrent content field...
CVE-2018-16773
The CVE-2018-16773 entry describes a Cross-Site Scripting (XSS) vulnerability in EasyCMS 1.5. The issue is triggered via a crafted payload in the content field accessed through index.php?s=/admin/fields/update/navTabId/listfields/callbackType/closeCurrent, implying an injection flaw in a web-faci...
CVE-2018-16773
EasyCMS 1.5 allows XSS via the index.php?s=/admin/fields/update/navTabId/listfields/callbackType/closeCurrent content field...
CVE-2018-16773
EasyCMS 1.5 allows XSS via the index.php?s=/admin/fields/update/navTabId/listfields/callbackType/closeCurrent content field...
CVE-2018-16773: Improper Neutralization of Input During Web Page Generation
EasyCMS 1.5 allows XSS via the index.php?s=/admin/fields/update/navTabId/listfields/callbackType/closeCurrent content field...
PT-2018-13737
Name of the Vulnerable Software and Affected Versions EasyCMS version 1.5 Description The issue allows for XSS via the index.php?s=/admin/fields/update/navTabId/listfields/callbackType/closeCurrent content field. Recommendations For EasyCMS version 1.5, update to a version that includes a fix for...
CVE-2018-16759
The removeXSS function in App/Common/common.php called from App/Modules/Index/Action/SearchAction.class.php in EasyCMS v1.4 allows XSS via an onhashchange event...
CVE-2018-16759
The removeXSS function in App/Common/common.php called from App/Modules/Index/Action/SearchAction.class.php in EasyCMS v1.4 allows XSS via an onhashchange event...
Design/Logic Flaw
The removeXSS function in App/Common/common.php called from App/Modules/Index/Action/SearchAction.class.php in EasyCMS v1.4 allows XSS via an onhashchange event...
CVE-2018-16759
The CVE-2018-16759 entry concerns EasyCMS v1.4. The vulnerability is in the removeXSS function (App/Common/common.php), invoked by App/Modules/Index/Action/SearchAction.class.php, which allows cross-site scripting via an onhashchange event. The issue is concretely described across multiple source...
CVE-2018-16759
The removeXSS function in App/Common/common.php called from App/Modules/Index/Action/SearchAction.class.php in EasyCMS v1.4 allows XSS via an onhashchange event...
CVE-2018-16759
The removeXSS function in App/Common/common.php called from App/Modules/Index/Action/SearchAction.class.php in EasyCMS v1.4 allows XSS via an onhashchange event...
CVE-2018-16759: Improper Neutralization of Input During Web Page Generation
The removeXSS function in App/Common/common.php called from App/Modules/Index/Action/SearchAction.class.php in EasyCMS v1.4 allows XSS via an onhashchange event...
PT-2018-13722
Name of the Vulnerable Software and Affected Versions EasyCMS version 1.4 Description The issue concerns the removeXSS function in EasyCMS, which is vulnerable to XSS attacks via an onhashchange event. This is due to the function's inadequate handling of certain events, allowing malicious scripts...
EasyCMS Cross-Site Request Forgery Vulnerability
EasyCMS is a scalable lightweight open source content management system CMS written in PHP. Cross-site request forgery vulnerability exists in EasyCMS version 1.5, which can be exploited by remote attackers to add a regular user and update the administrator password with the help of...
CVE-2018-16345
An issue was discovered in EasyCMS 1.5. There is a CSRF vulnerability that can update the admin password via index.php?s=/admin/rbacuser/update/navTabId/listusers/callbackType/closeCurrent...
CVE-2018-16345
An issue was discovered in EasyCMS 1.5. There is a CSRF vulnerability that can update the admin password via index.php?s=/admin/rbacuser/update/navTabId/listusers/callbackType/closeCurrent...
Cross site request forgery (csrf)
An issue was discovered in EasyCMS 1.5. There is a CSRF vulnerability that can update the admin password via index.php?s=/admin/rbacuser/update/navTabId/listusers/callbackType/closeCurrent...
CVE-2018-16345
Affected software: EasyCMS 1.5. Vulnerability: Cross-Site Request Forgery (CSRF) allows updating the administrator password via index.php?s=/admin/rbacuser/update/navTabId/listusers/callbackType/closeCurrent. Root cause: insufficient CSRF protection on the admin-update endpoint. Impact: unauthori...