CVE-2021-36547

A remote code execution RCE vulnerability in the component /codebase/dir.php?type=filenew of Mara v7.5 allows attackers to execute arbitrary commands via a crafted PHP file...

CVE-2021-36547

Summary: Mara CMS v7.5 contains a remote code execution (RCE) vulnerability in the component /codebase/dir.php?type=filenew. The root cause is alleged improper input filtering in the file upload logic, enabling an attacker to upload a crafted PHP file that can execute arbitrary commands. This iss...

CVE-2020-25422

MARA CMS 7.5 is affected by a Cross-Site Scripting (XSS) vulnerability in the menuedit.php component. The issue arises from improper handling of user-supplied/output data in that module (lack of checksum filtering per CNVD-2021-84589). Several databases (NVD, Red Hat, CNVD, CNVD-2021-84589, CNNVD...

CVE-2020-25422

A cross site scripting XSS vulnerability in menuedit.php of Mara CMS 7.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload...

Mara CMS 跨站脚本漏洞

Mara CMS is a file-based content management system. A cross-site scripting vulnerability exists in Mara CMS version 7.5, which stems from a lack of checksum filtering of user-supplied and output data in the menuedit.php component. An attacker can exploit this vulnerability to execute JavaScript...

Mara CMS 代码问题漏洞

Mara CMS is a file-based content management system. A file upload vulnerability exists in Mara v7.5, which stems from /codebase/dir.php?type=filenew failing to properly filter user input. An attacker can use this vulnerability to upload a webshell file to execute arbitrary commands...

Mara CMS Arbitrary File Upload Vulnerability

Mara CMS is a file-based content management system. An arbitrary file upload vulnerability exists in Mara CMS 7.5. An attacker with a valid authentication session can exploit this vulnerability by issuing a codebase/dir.php?type=filenew request to upload PHP code to codebase/handler.php, which ca...

CVE-2020-25042

An arbitrary file upload issue exists in Mara CMS 7.5. In order to exploit this, an attacker must have a valid authenticated admin/manager session and make a codebase/dir.php?type=filenew request to upload PHP code to codebase/handler.php...

Design/Logic Flaw

An arbitrary file upload issue exists in Mara CMS 7.5. In order to exploit this, an attacker must have a valid authenticated admin/manager session and make a codebase/dir.php?type=filenew request to upload PHP code to codebase/handler.php...

CVE-2020-25042

An arbitrary file upload issue exists in Mara CMS 7.5. In order to exploit this, an attacker must have a valid authenticated admin/manager session and make a codebase/dir.php?type=filenew request to upload PHP code to codebase/handler.php...

CVE-2020-25042

CVE-2020-25042 concerns Mara CMS 7.5 where an authenticated admin/manager can upload PHP via codebase/handler.php after invoking codebase/dir.php?type=filenew, enabling arbitrary code execution. The vulnerability is triggered by an authenticated session and a crafted request; public exploit detai...

PT-2020-15905 · Mara · Mara Cms

Name of the Vulnerable Software and Affected Versions: Mara CMS version 7.5 Description: An issue exists that allows arbitrary file upload. To exploit this, an attacker needs a valid authenticated session and must make a "codebase/dir.php?type=filenew" request to upload PHP code to...

Mara CMS Cross-Site Scripting Vulnerability

Mara CMS is a file-based content management system. A cross-site scripting vulnerability exists in Mara CMS 7.5. The vulnerability can be exploited to conduct cross-site scripting attacks via contact.php?theme=...

Mara CMS 7.5 - Reflective Cross-Site Scripting

Exploit Title: Mara CMS 7.5 - Reflective Cross-Site Scripting Google Dork: NA Date: 2020-08-01 Exploit Author: George Tsimpidas Vendor Homepage: https://sourceforge.net/projects/maracms/ Software Link: https://sourceforge.net/projects/maracms/files/MaraCMS75.zip/download Version: 7.5 Tested on:...

CVE-2020-24223

Mara CMS 7.5 allows cross-site scripting XSS in contact.php via the theme or pagetheme parameters...

CVE-2020-24223

Mara CMS 7.5 allows cross-site scripting XSS in contact.php via the theme or pagetheme parameters...

Cross site scripting

Mara CMS 7.5 allows cross-site scripting XSS in contact.php via the theme or pagetheme parameters...

CVE-2020-24223

Mara CMS 7.5 allows cross-site scripting XSS in contact.php via the theme or pagetheme parameters...

CVE-2020-24223

Mara CMS 7.5 is affected by a reflected XSS in contact.php via the theme or pagetheme parameters (root cause: improper sanitization of these inputs). The Nuclei template and multiple sources describe exploitation resulting in arbitrary JavaScript execution in the victim’s browser, with potential ...

PT-2020-15666 · Mara · Mara Cms

Name of the Vulnerable Software and Affected Versions: Mara CMS version 7.5 Description: The issue allows cross-site scripting XSS in contact.php via the theme or pagetheme parameters. This means an attacker could potentially inject malicious scripts into the website, affecting users who visit th...