Filter Gallery < 0.0.7 - Unauthorised AJAX Calls

The plugin had a logic flaw in the CSRF checks of its AJAX calls, allowing them to be passed by not providing the related parameter in the request. This could allow attacker to make logged in users do unwanted actions. Furthermore, the AJAX calls are also lacking capability checks, allowing any...

CVE-2020-36411

A stored cross scripting XSS vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Path for the pageimage tag:" or "Path for thumbnail field:" parameters under the "Content Editing Settings" module...

CVE-2020-36411

A stored cross scripting XSS vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Path for the pageimage tag:" or "Path for thumbnail field:" parameters under the "Content Editing Settings" module...

CVE-2020-36411

A stored cross scripting XSS vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Path for the pageimage tag:" or "Path for thumbnail field:" parameters under the "Content Editing Settings" module...

PT-2021-12049

Name of the Vulnerable Software and Affected Versions: CMS Made Simple version 2.2.14 Description: A stored cross scripting XSS issue allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the Path for the page image tag: or Path for thumbnail...

CVE-2020-36411: Improper Neutralization of Input During Web Page Generation

A stored cross scripting XSS vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Path for the pageimage tag:" or "Path for thumbnail field:" parameters under the "Content Editing Settings" module...

Vulnerability of PDF viewer programs such as Adobe Reader and Document Cloud, as well as PDF editing programs like Adobe Acrobat Document Cloud and Adobe Acrobat, lies in their ability to read data beyond the buffer in memory, allowing attackers to execute arbitrary code.

The vulnerabilities of PDF viewer programs such as Adobe Reader and Document Cloud, as well as PDF editing programs like Adobe Acrobat and Document Cloud, are related to reading data beyond the buffer in memory. Exploiting these vulnerabilities can allow a malicious actor to execute arbitrary cod...

XSS Vulnerability in Xunfei Documents of KUDA Xunfei Co.

Xunfei Documents is an online document app produced by KUDA Xunfei that supports simultaneous editing by multiple people and multiple ends. A XSS vulnerability exists in Xunfei Document of KUDA Xunfei Corporation, which can be exploited by an attacker to obtain an administrator cookie...

bloofoxCMS Cross-Site Request Forgery Vulnerability (CNVD-2021-43375)

bloofoxCMS is a free open source PHP + MySQL based Web content management system . A cross-site request forgery vulnerability exists in bloofoxCMS version 0.5.2.1. An attacker can exploit this vulnerability to edit the content of any file...

CVE-2020-35759

bloofoxCMS 0.5.2.1 is infected with a CSRF Attack that leads to an attacker editing any file content Locally/Remotely...

Cross site request forgery (csrf)

bloofoxCMS 0.5.2.1 is infected with a CSRF Attack that leads to an attacker editing any file content Locally/Remotely...

CVE-2020-35759

bloofoxCMS 0.5.2.1 is infected with a CSRF Attack that leads to an attacker editing any file content Locally/Remotely...

CVE-2020-35759

The provided connected documents confirm a CSRF vulnerability in bloofoxCMS 0.5.2.1 that permits an attacker to edit the content of any file. This is described consistently across CVE-2020-35759 records (NVD entry and CNVD/CNNVD variants) as a cross-site request forgery flaw in bloofoxCMS 0.5.2.1...

XSS Vulnerability in Cyberdrive Documents

Xunfei Documents is an online document app produced by KUDA Xunfei that supports multiple people editing at the same time on multiple devices, such as computers, mobile phones, tablets, and other types of devices to view and modify documents anytime, anywhere, and easily improve work efficiency...

The vulnerability of PDF viewing and editing programs like Adobe Acrobat Document Cloud and Acrobat Reader Document Cloud lies in the possibility of out-of-buffer operations in memory, allowing attackers to execute arbitrary code.

The vulnerability of PDF viewing and editing programs like Adobe Acrobat Document Cloud and Acrobat Reader Document Cloud lies in the execution of operations beyond the buffer limits in memory. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

The vulnerability of PDF viewing and editing programs like Adobe Acrobat Document Cloud and Acrobat Reader Document Cloud lies in the possibility of out-of-buffer operations, allowing attackers to gain unauthorized access to protected information.

The vulnerability of PDF viewing and editing programs like Adobe Acrobat Document Cloud and Acrobat Reader Document Cloud lies in the execution of operations beyond the buffer limits in memory. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected informatio...

ProjeQtOr Project Management 9.1.4 - Remote Code Execution Vulnerability

Exploit Title: ProjeQtOr Project Management 9.1.4 - Remote Code Execution Exploit Author: Temel Demir Vendor Homepage: https://www.projeqtor.org Software Link: https://sourceforge.net/projects/projectorria/files/projeqtorV9.1.4.zip Version: v9.1.4 Tested on: Laragon @WIN10 Description : Remote co...

CVE-2021-32621

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions prior to 12.6.7 and 12.10.3, a user without Script or Programming right is able to execute script requiring privileges by editing gadget titles in the dashboard. The issue has been...

CVE-2021-32621

Summary: CVE-2021-32621 affects XWiki Platform. In versions before 12.6.7 and 12.10.3, a user without Script or Programming rights can edit gadget titles in the dashboard to run scripts with privileges. The issue has been patched in XWiki 12.6.7, 12.10.3 and 13.0RC1. Impact (as stated): enables s...

Nextcloud: Federated editing allows iframing possibly malicious remotes

So this attack is less likely now that you killed the trusted server auto adding. But as far as I could tell you did not clear out old servers. Let me first describe the attack: 1. UserA on ServerA sends a federated share to userB on serverB 2. Assume serverA and serverB are trusted servers 3. No...