13592 matches found
Arbitrary file deletion
GreenCMS 2.3.0603 has an arbitrary file download vulnerability via an index.php?m=admin&c=media&a=downfile URI...
CVE-2018-12988
GreenCMS 2.3.0603 has an arbitrary file download vulnerability via an index.php?m=admin&c=media&a=downfile URI...
CVE-2018-12988
GreenCMS 2.3.0603 has an arbitrary file download vulnerability via an index.php?m=admin&c=media&a=downfile URI...
CVE-2018-12988
GreenCMS 2.3.0603 has an arbitrary file download vulnerability via an index.php?m=admin&c=media&a=downfile URI...
CVE-2018-12971
EasyCMS 1.3 is affected by a CSRF vulnerability that allows deleting users via the index.php?s=/admin/user/delAll URI. Multiple sources (NVD/NVD-derived entries, CVE lists, CNVD) corroborate that this is a CSRF flaw targeting the admin user deletion endpoint. The exact impact is deletion of users...
CVE-2018-13021: Unrestricted Upload of File with Dangerous Type
An issue was discovered in HongCMS 3.0.0. There is an Arbitrary Script File Upload issue that can result in PHP code execution via the admin/index.php/template/upload URI...
CVE-2018-12988: Improper Input Validation
GreenCMS 2.3.0603 has an arbitrary file download vulnerability via an index.php?m=admin&c=media&a=downfile URI...
PT-2018-11536
Name of the Vulnerable Software and Affected Versions WSTMall version 1.9.1 170316 Description The issue allows for CSRF via the "index.php?m=Admin&c=Users&a=edit" API endpoint to add a user account. This is achieved by exploiting the lack of proper CSRF protection, allowing an attacker to perfor...
PT-2018-11545
Name of the Vulnerable Software and Affected Versions YXcms version 1.4.7 Description The issue allows remote attackers to delete arbitrary files. This is achieved through the index.php?r=admin/photo/delpic endpoint, specifically by manipulating the picname parameter. Recommendations For YXcms...
PT-2018-11531
Name of the Vulnerable Software and Affected Versions Weblication CMS Core & Grid version 12.6.24 Description A cross-site scripting XSS issue was found in the Weblication CMS Core & Grid. The vulnerability is located in the wFilemanager.php and index.php files of the /grid5/scripts/ modules. The...
PT-2018-11504
Name of the Vulnerable Software and Affected Versions EasyCMS version 1.3 Description The issue allows for CSRF via the "index.php?s=/admin/user/delAll" URI to delete users. Recommendations For EasyCMS version 1.3, consider implementing proper CSRF protection mechanisms, such as token-based...
PT-2018-11541
Name of the Vulnerable Software and Affected Versions HongCMS version 3.0.0 Description An issue was discovered that allows for Arbitrary Script File Upload, which can result in PHP code execution. This is achievable via the "admin/index.php/template/upload" API endpoint. Recommendations For...
CVE-2018-13002: Improper Neutralization of Input During Web Page Generation
An XSS issue was discovered in Inhaltsprojekte in Weblication CMS Core & Grid v12.6.24. The vulnerability is located in the wFilemanager.php and index.php files of the /grid5/scripts/ modules. The injection point is located in the Project Title and the execution point occurs in the Inhaltsprojekt...
CVE-2018-13025: Incorrect Permission Assignment for Critical Resource
protected/apps/admin/controller/photoController.php in YXcms 1.4.7 allows remote attackers to delete arbitrary files via the index.php?r=admin/photo/delpic picname parameter...
CVE-2018-13010: Cross-Site Request Forgery (CSRF)
WSTMall v1.9.1170316 has CSRF via the index.php?m=Admin&c=Users&a=edit URI to add a user account...
CVE-2018-12971: Cross-Site Request Forgery (CSRF)
EasyCMS 1.3 has CSRF via the index.php?s=/admin/user/delAll URI to delete users...
PT-2018-11517
Name of the Vulnerable Software and Affected Versions GreenCMS version 2.3.0603 Description The issue allows for an arbitrary file download via the /index.php?m=admin&c=media&a=downfile API endpoint. Recommendations For GreenCMS version 2.3.0603, consider restricting access to the downfile action...
CVE-2018-12905
joyplus-cms 1.6.0 has XSS in adminplayer.php, related to manager/index.php "system manage" and "add" actions...
