279 matches found
CVE-2018-19465
Maccms through 8.0 allows XSS via the sitekeywords field to index.php?m=system-config because of tpl/module/system.php and tpl/html/systemconfig.html, related to template/paody/html/vodindex.html...
Sql injection
Maccms through 8.0 allows XSS via the sitekeywords field to index.php?m=system-config because of tpl/module/system.php and tpl/html/systemconfig.html, related to template/paody/html/vodindex.html...
CVE-2018-19465
Maccms through 8.0 allows XSS via the sitekeywords field to index.php?m=system-config because of tpl/module/system.php and tpl/html/systemconfig.html, related to template/paody/html/vodindex.html...
CVE-2018-19465
CVE-2018-19465 affects Maccms up to version 8.0, allowing Cross-Site Scripting (XSS) via the site_keywords field used in index.php?m=system-config. The root cause is tied to template files: tpl/module/system.php and tpl/html/system_config.html, with related references to template/paody/html/vod_i...
Arbitrary File Deletion Vulnerability in maccms
maccms is a cms website builder. maccms is vulnerable to an arbitrary file deletion vulnerability. An attacker can exploit the vulnerability to delete arbitrary files, resulting in system reinstallation...
Arbitrary File Read Vulnerability in maccms
maccms is a cms website builder. maccms has an arbitrary file reading vulnerability that can be exploited by an attacker to read arbitrary files...
CVE-2019-9829
Maccms 10 allows remote attackers to execute arbitrary PHP code by entering this code in a template/defaultpc/html/art Edit action. This occurs because template rendering uses an include operation on a cache file, which bypasses the prohibition of .php files as templates...
Design/Logic Flaw
Maccms 10 allows remote attackers to execute arbitrary PHP code by entering this code in a template/defaultpc/html/art Edit action. This occurs because template rendering uses an include operation on a cache file, which bypasses the prohibition of .php files as templates...
CVE-2019-9829
Maccms 10 allows remote attackers to execute arbitrary PHP code by entering this code in a template/defaultpc/html/art Edit action. This occurs because template rendering uses an include operation on a cache file, which bypasses the prohibition of .php files as templates...
CVE-2019-9829
Maccms 10 allows remote attackers to execute arbitrary PHP code by entering this code in a template/defaultpc/html/art Edit action. This occurs because template rendering uses an include operation on a cache file, which bypasses the prohibition of .php files as templates...
CVE-2019-9829
CVE-2019-9829 affects Maccms 10. The vulnerability arises from template rendering that uses an include operation on a cache file, bypassing the prohibition of .php files as templates, allowing remote attackers to execute arbitrary PHP code. Documented impact is high (CVSSv3 base score 8.8; networ...
Maccms Arbitrary PHP Code Execution Vulnerability
Maccms is a PHP-based content management system CMS for film and television. A code injection vulnerability exists in Maccms version 10. A remote attacker can exploit this vulnerability to inject and execute arbitrary PHP code...
MacCMS Cross-Site Scripting Vulnerability
Maccms is a PHP-based content management system CMS for film and television. A cross-site scripting vulnerability exists in the inc/config/cache.php file in Maccms version 8.0, which stems from the incorrect handling of the 'keywords' parameter in the template/paody/html/vodtype.html file and the...
Cross site scripting
Maccms 8.0 allows XSS via the inc/config/cache.php tkey parameter because template/paody/html/vodtype.html mishandles the keywords parameter, and a/tpl/module/db.php only filters the tname parameter not tkey...
CVE-2019-8410
Maccms 8.0 allows XSS via the inc/config/cache.php tkey parameter because template/paody/html/vodtype.html mishandles the keywords parameter, and a/tpl/module/db.php only filters the tname parameter not tkey...
CVE-2019-8410
Maccms 8.0 allows XSS via the inc/config/cache.php tkey parameter because template/paody/html/vodtype.html mishandles the keywords parameter, and a/tpl/module/db.php only filters the tname parameter not tkey...
CVE-2019-8410
Maccms 8.0 allows XSS via the inc/config/cache.php tkey parameter because template/paody/html/vodtype.html mishandles the keywords parameter, and a/tpl/module/db.php only filters the tname parameter not tkey...
CVE-2019-8410
CVE-2019-8410 affects Maccms 8.0, where an XSS exists due to improper handling of the t_key parameter in inc/config/cache.php and the related template logic in template/paody/html/vod_type.html, with a/tpl/module/db.php only filtering t_name. The vulnerability enables an attacker to store a scrip...
MACCMS 10 Cross-Site Request Forgery Vulnerability
MacCMS program is a fast shadow video building system that runs on PHP+MYSQL environment. MACCMS 10 has a cross-site request forgery vulnerability, which can be exploited by attackers to arbitrarily add to users...