332 matches found
CVE-2018-20188
FUEL CMS 1.4.3 has CSRF via users/create/ to add an administrator account...
Cross site request forgery (csrf)
FUEL CMS 1.4.3 has CSRF via users/create/ to add an administrator account...
CVE-2018-20188
CVE-2018-20188 affects FUEL CMS 1.4.3, where a cross-site request forgery (CSRF) via the /users/create/ endpoint can be abused to add an administrator account. The connected Red Hat/ENISA/CNVD/NVD sources corroborate the same description, indicating the vulnerability status and impact as describe...
CVE-2018-20188
FUEL CMS 1.4.3 has CSRF via users/create/ to add an administrator account...
CVE-2018-20136
XSS exists in FUEL CMS 1.4.3 via the Header or Body in the Layout Variables during new-page creation, as demonstrated by the pages/edit/1?lang=english URI...
Cross site scripting
XSS exists in FUEL CMS 1.4.3 via the Page title, Meta description, or Meta keywords during page data management, as demonstrated by the pages/edit/1?lang=english URI...
Cross site scripting
XSS exists in FUEL CMS 1.4.3 via the Header or Body in the Layout Variables during new-page creation, as demonstrated by the pages/edit/1?lang=english URI...
CVE-2018-20136
XSS exists in FUEL CMS 1.4.3 via the Header or Body in the Layout Variables during new-page creation, as demonstrated by the pages/edit/1?lang=english URI...
CVE-2018-20137
XSS exists in FUEL CMS 1.4.3 via the Page title, Meta description, or Meta keywords during page data management, as demonstrated by the pages/edit/1?lang=english URI...
CVE-2018-20137
XSS exists in FUEL CMS 1.4.3 via the Page title, Meta description, or Meta keywords during page data management, as demonstrated by the pages/edit/1?lang=english URI...
CVE-2018-20136
CVE-2018-20136 affects FUEL CMS 1.4.3, where an XSS flaw exists in the Header or Body within Layout Variables during new-page creation (demonstrated via pages/edit/1?lang=english). The root cause is input reflected in layout variables, enabling script injection. Impact is cross-site scripting; ex...
CVE-2018-20137
CVE-2018-20137 affects FUEL CMS 1.4.3. The vulnerability is a cross-site scripting flaw exposed in page data management, specifically via the Page title, Meta description, or Meta keywords in the pages/edit/1?lang=english URI. The connected documents confirm the issue but do not provide a fix or ...
CVE-2018-20136
XSS exists in FUEL CMS 1.4.3 via the Header or Body in the Layout Variables during new-page creation, as demonstrated by the pages/edit/1?lang=english URI...
CVE-2018-20137
XSS exists in FUEL CMS 1.4.3 via the Page title, Meta description, or Meta keywords during page data management, as demonstrated by the pages/edit/1?lang=english URI...
FUEL CMS SQL Injection Vulnerability
FUEL CMS is a content management system based on CodeIgniter. FUEL CMS 1.4.1 suffers from a SQL injection vulnerability that can be exploited by an attacker via the layout, published or searchterm parameters of pages/items...
Remote code execution
FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. This can lead to Pre-Auth Remote Code Execution...
CVE-2018-16763
FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. This can lead to Pre-Auth Remote Code Execution...
CVE-2018-16763
FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. This can lead to Pre-Auth Remote Code Execution...