Cross site request forgery (csrf)

An issue was discovered in EasyCMS 1.5. There is a CSRF vulnerability that can update the admin password via index.php?s=/admin/rbacuser/update/navTabId/listusers/callbackType/closeCurrent...

CVE-2018-16345

An issue was discovered in EasyCMS 1.5. There is a CSRF vulnerability that can update the admin password via index.php?s=/admin/rbacuser/update/navTabId/listusers/callbackType/closeCurrent...

CVE-2018-16345

Affected software: EasyCMS 1.5. Vulnerability: Cross-Site Request Forgery (CSRF) allows updating the administrator password via index.php?s=/admin/rbacuser/update/navTabId/listusers/callbackType/closeCurrent. Root cause: insufficient CSRF protection on the admin-update endpoint. Impact: unauthori...

Cross site request forgery (csrf)

EasyCMS 1.3 has CSRF via the index.php?s=/admin/user/delAll URI to delete users...

CVE-2018-12971

EasyCMS 1.3 has CSRF via the index.php?s=/admin/user/delAll URI to delete users...

CVE-2018-12971

EasyCMS 1.3 has CSRF via the index.php?s=/admin/user/delAll URI to delete users...

CVE-2018-12971

EasyCMS 1.3 has CSRF via the index.php?s=/admin/user/delAll URI to delete users...

CVE-2018-12971

EasyCMS 1.3 is affected by a CSRF vulnerability that allows deleting users via the index.php?s=/admin/user/delAll URI. Multiple sources (NVD/NVD-derived entries, CVE lists, CNVD) corroborate that this is a CSRF flaw targeting the admin user deletion endpoint. The exact impact is deletion of users...

EasyCMS Cross-Site Request Forgery Vulnerability

EasyCMS is a scalable lightweight open source content management system CMS written in PHP. A cross-site request forgery vulnerability exists in EasyCMS version 1.3. A remote attacker can exploit this vulnerability to delete users with the help of index.php?s=/admin/user/delAll URI...

EasyCMS Cross-Site Scripting Vulnerability (CNVD-2018-08985)

EasyCMS is a lightweight scalable open source content management system CMS written in PHP. A cross-site scripting vulnerability exists in EasyCMS version 1.3. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML with the title, keyword, abstract and content...

CVE-2018-10527

EasyCMS 1.3 is prone to Stored XSS when posting an article; four fields are affected: title, keyword, abstract, and content, as demonstrated by the /admin/index/index.htmllistarticle URI...

Cross site scripting

EasyCMS 1.3 is prone to Stored XSS when posting an article; four fields are affected: title, keyword, abstract, and content, as demonstrated by the /admin/index/index.htmllistarticle URI...

CVE-2018-10527

EasyCMS 1.3 is prone to Stored XSS when posting an article; four fields are affected: title, keyword, abstract, and content, as demonstrated by the /admin/index/index.htmllistarticle URI...

CVE-2018-10527

EasyCMS 1.3 is prone to Stored XSS when posting an article; four fields are affected: title, keyword, abstract, and content, as demonstrated by the /admin/index/index.htmllistarticle URI...

CVE-2018-10527

CVE-2018-10527 affects EasyCMS 1.3 and is described as a Stored XSS vulnerability. The issue affects four input fields when posting an article: title, keyword, abstract, and content, as demonstrated by the /admin/index/index.html#listarticle URI. The related documents confirm the existence of the...

EasyCMS Cross-Site Scripting Vulnerability

EasyCMS is a lightweight scalable open source content management system CMS written in PHP. A cross-site scripting vulnerability exists in EasyCMS version 1.3. A remote attacker can use the 's' POST parameter in the index.php?s=/index/search/index.html request to inject arbitrary Web script or HM...

CVE-2018-10374

EasyCMS 1.3 has XSS via the s POST parameter aka a search box value in an index.php?s=/index/search/index.html request...

Server side request forgery (ssrf)

EasyCMS 1.3 has XSS via the s POST parameter aka a search box value in an index.php?s=/index/search/index.html request...

CVE-2018-10374

EasyCMS 1.3 has XSS via the s POST parameter aka a search box value in an index.php?s=/index/search/index.html request...

CVE-2018-10374

EasyCMS 1.3 has XSS via the s POST parameter aka a search box value in an index.php?s=/index/search/index.html request...