CVE-2022-28918

GreenCMS v2.3.0603 was discovered to contain an arbitrary file deletion vulnerability via /index.php?m=admin&c=custom&a=plugindelhandle&pluginname=...

CVE-2022-28918

GreenCMS v2.3.0603 is affected by an arbitrary file deletion vulnerability exploitable over the network via /index.php?m=admin&c=custom&a=plugindelhandle&plugin_name=. The CVE entry indicates this allows deletion of arbitrary files, with CVSSv3.1 base score 8.1 (HIGH) and a network attack vector;...

CVE-2022-28918

GreenCMS v2.3.0603 was discovered to contain an arbitrary file deletion vulnerability via /index.php?m=admin&c=custom&a=plugindelhandle&pluginname=...

CVE-2022-28528

bloofoxCMS v0.5.2.1 was discovered to contain an arbitrary file upload vulnerability via /admin/index.php?mode=content&page=media&action=edit...

CVE-2022-28523

HongCMS 3.0.0 allows arbitrary file deletion via the component /admin/index.php/template/ajax?action=delete...

CVE-2022-28522

ZCMS v20170206 contains a stored XSS vulnerability in index.php?m=home&c=message&a=add. The root cause is a stored cross-site scripting flaw in the message add endpoint, allowing injection that can affect other users. According to the provided sources, the impact is C=L/I=L (partial integrity imp...

CVE-2022-28521

CVE-2022-28521 affects ZCMS v20170206 (thinkphp-zcms). The vulnerability is a file inclusion flaw in index.php?m=home&c=home&a=sp_set_config that can lead to arbitrary code execution. Several sources (NVD, CNVD/CNNVD, Red Hat, PRION) corroborate the file inclusion risk; exploitation status is not...

CVE-2022-28521

ZCMS v20170206 was discovered to contain a file inclusion vulnerability via index.php?m=home&c=home&a=spsetconfig...

CVE-2022-28522: Improper Neutralization of Input During Web Page Generation

ZCMS v20170206 was discovered to contain a stored cross-site scripting XSS vulnerability via index.php?m=home&c=message&a=add...

PT-2022-19062

Name of the Vulnerable Software and Affected Versions ZCMS version v20170206 Description A stored cross-site scripting XSS issue was found in ZCMS. The issue is exploited via the index.php endpoint with specific parameters: m=home, c=message, and a=add. This allows for malicious script execution...

CVE-2022-28523: Improper Limitation of a Pathname to a Restricted Directory

HongCMS 3.0.0 allows arbitrary file deletion via the component /admin/index.php/template/ajax?action=delete...

CVE-2022-28521: Undefined Security Weakness

ZCMS v20170206 was discovered to contain a file inclusion vulnerability via index.php?m=home&c=home&a=spsetconfig...

PT-2022-19061

Name of the Vulnerable Software and Affected Versions ZCMS version v20170206 Description A file inclusion issue was discovered in ZCMS, which can be exploited via the "index.php" endpoint with specific parameters, including m, c, and a. The vulnerability is triggered when an attacker manipulates...

PT-2022-19063

Name of the Vulnerable Software and Affected Versions HongCMS version 3.0.0 Description The issue allows for arbitrary file deletion. This can be achieved via the component /admin/index.php/template/ajax?action=delete. Recommendations For HongCMS version 3.0.0, as a temporary workaround, consider...

PT-2022-19067

Name of the Vulnerable Software and Affected Versions bloofoxCMS version 0.5.2.1 Description The issue is related to an arbitrary file upload vulnerability. This vulnerability can be exploited via the "/admin/index.php?mode=content&page=media&action=edit" API endpoint. Recommendations For...

PT-2022-12429

Name of the Vulnerable Software and Affected Versions Terramaster F4-210, F2-210 TOS version 4.2.X 4.2.15-2107141517 Description The issue allows for the execution of arbitrary commands as root by sending specifically crafted input to the "/tos/index.php?app/app start stop" API endpoint...

CVE-2021-45836: Undefined Security Weakness

An authenticated attacker can execute arbitrary commands as root in Terramaster F4-210, F2-210 TOS 4.2.X 4.2.15-2107141517 by injecting a maliciously crafted input in the request through /tos/index.php?app/handapp...

CVE-2021-45840: Undefined Security Weakness

It is possible to execute arbitrary commands as root in Terramaster F4-210, F2-210 TOS 4.2.X 4.2.15-2107141517 by sending specifically crafted input to /tos/index.php?app/appstartstop...

CVE-2021-45837: Undefined Security Weakness

It is possible to execute arbitrary commands as root in Terramaster F4-210, F2-210 TOS 4.2.X 4.2.15-2107141517 by sending a specifically crafted input to /tos/index.php?app/del...

PT-2022-18421

Name of the Vulnerable Software and Affected Versions GalleryCMS version 2.0 Description A stored cross-site scripting XSS issue exists in the /index.php/album/add endpoint of GalleryCMS, allowing attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the album nam...