imFAQ 安全漏洞

imFAQ is an advanced question and answer management system for ImpressCMS websites open-sourced by Impress Modules. A security vulnerability exists in versions prior to imFAQ 1.0.1 that stems from seoOp parameters that are not cleaned or validated, which could lead to a local file inclusion that...

The vulnerability of the processimage.php component in the ImpressCMS CMS system allows a hacker to execute arbitrary code.

The vulnerability of the processimage.php component in the ImpressCMS CMS system is related to deficiencies in path name restrictions for the catalog. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

ImpressCMS Cross-Site Scripting Vulnerability (CNVD-2023-59104)

ImpressCMS is a MySQL-based, modular content management system CMS. The system includes modules for press releases, forums and photo albums. A cross-site scripting vulnerability exists in ImpressCMS v1.4.5 and earlier versions, which stems from the lack of effective filtering and escaping of...

ImpressCMS Cross-site Scripting vulnerability

A cross-site scripting XSS vulnerability in ImpressCMS v1.4.5 and before allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the smilecode parameter of the component /editprofile.php...

GHSA-667R-P4GG-7M2Q ImpressCMS Cross-site Scripting vulnerability

A cross-site scripting XSS vulnerability in ImpressCMS v1.4.5 and before allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the smilecode parameter of the component /editprofile.php...

CVE-2023-37785

A cross-site scripting XSS vulnerability in ImpressCMS v1.4.5 and before allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the smilecode parameter of the component /editprofile.php...

CVE-2023-37785

A cross-site scripting XSS vulnerability in ImpressCMS v1.4.5 and before allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the smilecode parameter of the component /editprofile.php...

Cross site scripting

A cross-site scripting XSS vulnerability in ImpressCMS v1.4.5 and before allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the smilecode parameter of the component /editprofile.php...

CVE-2023-37785

A cross-site scripting XSS vulnerability in ImpressCMS v1.4.5 and before allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the smilecode parameter of the component /editprofile.php...

CVE-2023-37785

ImpressCMS is affected: versions v1.4.5 and earlier. The XSS flaw resides in the smile_code parameter of editprofile.php, caused by insufficient input filtering/escaping. Successful exploitation enables execution of arbitrary web scripts/HTML in a logged-in user context, as described across multi...

ImpressCMS 跨站脚本漏洞

ImpressCMS is a MySQL-based, modular content management system CMS. The system includes modules for press releases, forums and photo albums. A cross-site scripting vulnerability exists in ImpressCMS v1.4.5 and earlier versions, which stems from the lack of effective filtering and escaping of...

ImpressCMS v1.4.3 - Authenticated SQL Injection Vulnerability

Exploit Title: Authenticated Sql Injection in ImpressCMS v1.4.3 Exploit Author: Sarang Tumne @CyberInsane Twitter: @thecyberinsane CVE ID: CVE-2022-26986 Confirmed on release 1.4.3, this vulnerability is patched in the version 1.4.4 and above... Vendor: https://www.impresscms.org Source:...

ImpressCMS 1.4.3 SQL Injection

Exploit Title: Authenticated Sql Injection in ImpressCMS v1.4.3 Exploit Author: Sarang Tumne @CyberInsane Twitter: @thecyberinsane Date: 7th March 2022 CVE ID: CVE-2022-26986 Confirmed on release 1.4.3, this vulnerability is patched in the version 1.4.4 and above... Vendor:...

ImpressCMS v1.4.3 - Authenticated SQL Injection

Exploit Title: Authenticated Sql Injection in ImpressCMS v1.4.3 Exploit Author: Sarang Tumne @CyberInsane Twitter: @thecyberinsane Date: 7th March 2022 CVE ID: CVE-2022-26986 Confirmed on release 1.4.3, this vulnerability is patched in the version 1.4.4 and above... Vendor:...

ImpressCMS Directory Traversal (CVE-2022-24977)

A directory traversal vulnerability exists in ImpressCMS. Successful exploitation of this vulnerability could allow an attacker to access arbitrary files on the affected system...

Malicious code in @impresscms/fetlife-assets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0aaf5018cdf58393a3c22158c2784504059026f2b4f2a9a9bb374fdcace9fe8e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-355 Malicious code in @impresscms/fetlife-assets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0aaf5018cdf58393a3c22158c2784504059026f2b4f2a9a9bb374fdcace9fe8e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-G32Q-4FHF-CQ72 ImpressCMS XSS

ImpressCMS 1.3.10 has XSS via the PATHINFO to htdocs/install/index.php, htdocs/install/pagelangselect.php, or htdocs/install/pagemodcheck.php...

ImpressCMS XSS

ImpressCMS 1.3.10 has XSS via the PATHINFO to htdocs/install/index.php, htdocs/install/pagelangselect.php, or htdocs/install/pagemodcheck.php...

GHSA-F5JH-Q6MP-9C8P ImpressCMS Cross-site scripting Vulnerability

A cross-site scripting XSS vulnerability in modules/system/admin.php in ImpressCMS 1.3.6.1 allows remote attackers to inject arbitrary web script or HTML via the query parameter in a listimg action...