Directory traversal

BlogEngine.NET 3.3.7.0 and earlier allows Directory Traversal and Remote Code Execution via the theme cookie to the File Manager. NOTE: this issue exists because of an incomplete fix for CVE-2019-6714...

CVE-2019-10720

BlogEngine.NET 3.3.7.0 and earlier allows Directory Traversal and Remote Code Execution via the theme cookie to the File Manager. NOTE: this issue exists because of an incomplete fix for CVE-2019-6714...

CVE-2019-10720: Improper Limitation of a Pathname to a Restricted Directory

BlogEngine.NET 3.3.7.0 and earlier allows Directory Traversal and Remote Code Execution via the theme cookie to the File Manager. NOTE: this issue exists because of an incomplete fix for CVE-2019-6714...

PT-2019-12010

Name of the Vulnerable Software and Affected Versions BlogEngine.NET versions 3.3.7.0 and earlier Description The issue allows Directory Traversal and Remote Code Execution via the theme cookie to the File Manager. This problem exists due to an incomplete fix for a previous issue. Recommendations...

CVE-2016-10759

The Xinha plugin in Precurio 2.1 allows Directory Traversal, with resultant arbitrary code execution, via ExtendedFileManager/Classes/ExtendedFileManager.php because ExtendedFileManager can be used to rename the .htaccess file that blocks .php uploads...

Cross site scripting

XSS was discovered in CentOS-WebPanel.com aka CWP CentOS Web Panel through 0.9.8.747 via the testacc/fileManager2.php fmcurrentdir or filename parameter...

CVE-2019-12190

XSS was discovered in CentOS-WebPanel.com aka CWP CentOS Web Panel through 0.9.8.747 via the testacc/fileManager2.php fmcurrentdir or filename parameter...

PT-2019-12689 · Centos · Centos Web Panel

Name of the Vulnerable Software and Affected Versions: CentOS Web Panel versions through 0.9.8.747 Description: A cross-site scripting XSS issue was found in the CentOS Web Panel. The issue is related to the fm current dir or filename parameter in the testacc/fileManager2.php endpoint...

DoorGets Sensitive Information Disclosure Vulnerability (CNVD-2019-13790)

DoorGets is a free and open source content management system. A sensitive information disclosure vulnerability exists in /fileman/php/renamefile.php in doorGets 7.0. A remote, unauthenticated attacker can exploit this vulnerability to obtain sensitive information about the server or make the serv...

CMS Made Simple <= 2.2.12 Multiple Reflected XSS Vulnerabilities

CMS Made Simple is prone to multiple reflected cross-site scripting XSS vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2018-18823

WolfCMS 0.8.3.1 allows XSS via an SVG file to /?/admin/plugin/filemanager/browse/...

CVE-2019-11513

The File Manager in CMS Made Simple through 2.2.10 has Reflected XSS via the "New name" field in a Rename action...

CVE-2019-11513

The File Manager in CMS Made Simple through 2.2.10 has Reflected XSS via the "New name" field in a Rename action...

Design/Logic Flaw

The File Manager in CMS Made Simple through 2.2.10 has Reflected XSS via the "New name" field in a Rename action...

CVE-2019-11513

CMS Made Simple’s File Manager (affected through version 2.2.10) is vulnerable to a Reflected XSS in the Rename action via the New name field. The connected sources consistently describe a reflected XSS condition in this component; no patch/version fix is specified in the provided documents. Expl...

CVE-2019-11513

The File Manager in CMS Made Simple through 2.2.10 has Reflected XSS via the "New name" field in a Rename action...

PT-2019-9642

Name of the Vulnerable Software and Affected Versions WolfCMS version 0.8.3.1 Description The issue allows for XSS via an SVG file. This can be achieved by accessing the /admin/plugin/file manager/browse/ API endpoint. Recommendations For WolfCMS version 0.8.3.1, update to a newer version that...

CVE-2019-11513: Improper Neutralization of Input During Web Page Generation

The File Manager in CMS Made Simple through 2.2.10 has Reflected XSS via the "New name" field in a Rename action...

PT-2019-12346

Name of the Vulnerable Software and Affected Versions CMS Made Simple versions through 2.2.10 Description The issue concerns a Reflected XSS in the File Manager component. This occurs via the New name field when performing a Rename action. Recommendations For versions through 2.2.10, update to a...

PT-2019-9643

Name of the Vulnerable Software and Affected Versions WolfCMS version 0.8.3.1 Description The issue allows for XSS via an SVG file. This can be exploited by accessing the /admin/plugin/file manager/browse/ API endpoint. Recommendations For WolfCMS version 0.8.3.1, consider restricting access to t...