359 matches found
CVE-2018-18891: Improper Authentication
MiniCMS 1.10 allows file deletion via /mc-admin/post.php?state=delete&delete= because the authentication check occurs too late...
PT-2018-14712
Name of the Vulnerable Software and Affected Versions MiniCMS version 1.10 Description The issue allows for file deletion due to an authentication check occurring too late. This can be exploited via the "/mc-admin/post.php?state=delete&delete=" endpoint, where an attacker can delete files without...
PT-2018-14713
Name of the Vulnerable Software and Affected Versions MiniCMS version 1.10 Description The issue allows execution of arbitrary PHP code via the sitename parameter in the install.php endpoint, affecting the site name field in mc conf.php. Recommendations For MiniCMS version 1.10, consider...
Cross site scripting
MiniCMS 1.10, when Internet Explorer is used, allows XSS via a crafted URI because $SERVER'REQUESTURI' is mishandled...
CVE-2018-17039
MiniCMS 1.10, when Internet Explorer is used, allows XSS via a crafted URI because $SERVER'REQUESTURI' is mishandled...
CVE-2018-17039
MiniCMS 1.10, when Internet Explorer is used, allows XSS via a crafted URI because $SERVER'REQUESTURI' is mishandled...
CVE-2018-17039
MiniCMS 1.10, when Internet Explorer is used, allows XSS via a crafted URI because $SERVER'REQUESTURI' is mishandled...
CVE-2018-17039
CVE-2018-17039 affects MiniCMS 1.10. The issue is a cross-site scripting (XSS) vulnerability when Internet Explorer is used, caused by mishandling of $_SERVER['REQUEST_URI'] when processing a crafted URI. The connected documents confirm the vulnerability details and affected component, but do not...
PT-2018-13854
Name of the Vulnerable Software and Affected Versions MiniCMS version 1.10 Description The issue allows for XSS via a crafted URI due to the mishandling of $ SERVER'REQUEST URI' when Internet Explorer is used. Recommendations For MiniCMS version 1.10, consider validating and sanitizing user input...
CVE-2018-17039: Improper Neutralization of Input During Web Page Generation
MiniCMS 1.10, when Internet Explorer is used, allows XSS via a crafted URI because $SERVER'REQUESTURI' is mishandled...
Design/Logic Flaw
An issue was discovered in MiniCMS 1.10. There is an mc-admin/post.php?tag= XSS vulnerability for a state=delete, state=draft, or state=publish request...
CVE-2018-16298
An issue was discovered in MiniCMS 1.10. There is an mc-admin/post.php?tag= XSS vulnerability for a state=delete, state=draft, or state=publish request...
CVE-2018-16298
An issue was discovered in MiniCMS 1.10. There is an mc-admin/post.php?tag= XSS vulnerability for a state=delete, state=draft, or state=publish request...
CVE-2018-16298
An issue was discovered in MiniCMS 1.10. There is an mc-admin/post.php?tag= XSS vulnerability for a state=delete, state=draft, or state=publish request...
CVE-2018-16298
MiniCMS 1.10 is affected by a cross-site scripting (XSS) vulnerability in the admin endpoint mc-admin/post.php?tag= where requests with state=delete, state=draft, or state=publish can inject script or HTML. The flaw is triggered via the tag parameter and is present in the public CVE entries acros...
MiniCMS Cross-Site Scripting Vulnerability (CNVD-2018-17188)
MiniCMS is a micro content management system designed for personal websites. A cross-site scripting vulnerability exists in MiniCMS 1.10. An attacker can exploit this vulnerability by using the mc-admin/post-edit.php tags parameter to conduct cross-site scripting attacks...
CVE-2018-16298: Improper Neutralization of Input During Web Page Generation
An issue was discovered in MiniCMS 1.10. There is an mc-admin/post.php?tag= XSS vulnerability for a state=delete, state=draft, or state=publish request...
PT-2018-13474
Name of the Vulnerable Software and Affected Versions MiniCMS version 1.10 Description An issue was discovered in MiniCMS. There is an XSS vulnerability in the 'mc-admin/post.php' endpoint for requests with a 'state' parameter set to 'delete', 'draft', or 'publish'. Recommendations For MiniCMS...