CatfishCMS has a file upload vulnerability

Catfish CMS is a free and open source PHP content management system. A file upload vulnerability exists in CatfishCMS, which can be exploited by an attacker to gain control of the server...

SQL Injection Vulnerability in PHPCMS of Coolmouse (Beijing) Culture Media Co.

PHPCMS is a self-developed framework using the OOP object-oriented approach. There is a SQL injection vulnerability in PHPCMS of CoolSkate Beijing Culture Media Co. Ltd, which can be exploited by attackers to obtain sensitive information from the database...

Extreme CMS suffers from SQL injection vulnerability (CNVD-2020-44107)

Extreme CMS is an open source PHPCMS web content management system. Extreme CMS suffers from a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive database information...

PHPCMS version 9.1.5 to 9.6.3 SQL injection vulnerability in content module si***.php page

PHPCMS uses PHP5+MYSQL as the technical basis for development.V9 uses OOP object-oriented approach to build the basic operational framework. PHPCMS 9.1.5 to 9.6.3 versions of the content module si.php page there is a SQL injection vulnerability, attackers can use the vulnerability to obtain...

Langfang Extreme Networks Technology Co. Extreme CMS has file upload vulnerability

Extreme CMS is an open source PHPCMS web content management system. Ltd. Extreme CMS has a file upload vulnerability that can be exploited by attackers to upload malicious files to gain server privileges...

File upload vulnerability in the ap***_co***.php file in the background of PHPOK enterprise website building system (CNVD-2019-21282)

PHPOK is a set of enterprise station CMS system developed in PHP + MYSQL language. A file upload vulnerability exists in the apco.php file in the background of the PHPOK enterprise website system. Remote attackers can use this vulnerability to obtain server administrative privileges...

CVE-2019-10027

PHPCMS 9.6.x through 9.6.3 has XSS via the mailbox aka E-mail field on the personal information screen...

JTBC(PHP) File Upload Vulnerability

JTBC PHP is a PHP-based open source content management system CMS. A file upload vulnerability exists in JTBCPHP version 3.0.1.8, which can be exploited to upload arbitrary files with the help of console//console/file/manage.php?type=list URI...

CVE-2018-14940

PHPCMS 9 allows remote attackers to cause a denial of service resource consumption via large fontsize, height, and width parameters in an api.php?op=checkcode request...

SeaCMS Cross-Site Request Forgery Vulnerability (CNVD-2018-14275)

SeaCMS is a free and open source web content management system written in PHP. The system has been designed primarily to manage video-on-demand resources. A cross-site request forgery vulnerability exists in SeaCMS version 6.61. A remote attacker can exploit this vulnerability to add an...

Code Execution Vulnerability in PHPCMS v9.6.3

PHPCMS is a web content management system based on PHP and Mysql architecture. A code execution vulnerability exists in the backend of phpcms version v9.6.3, which can be exploited by attackers to gain server privileges...

PHPCMS V9.6.3 CSRF Vulnerability and Arbitrary File Write Vulnerability in the Backend

PHPCMS is a web content management system based on PHP and Mysql architecture. PHPcms V9.6.3 version of the backend exists CSRF vulnerability and arbitrary file write vulnerability. Attackers can use this vulnerability to remotely write Trojan horse files to obtain web server administrative...

[SECURITY] Fedora 24 Update: drupal7-7.56-1.fc24

Equipped with a powerful blend of features, Drupal is a Content Management System written in PHP that can support a variety of websites ranging from personal weblogs to large community-driven websites. Drupal is highly configurable, skinnable, and secure...

PHPCMS '/phpcms/modules/member/index.php' file upload vulnerability

PHPCMS is a website management software. The software adopts modular development and supports a variety of classification methods, using it can easily realize the design, development and maintenance of personalized websites. A file upload vulnerability exists in PHPCMS...

PHPCMS 'phpcms\modules\member\index.php ' Arbitrary Password Reset Vulnerability

PHPCMS is a website management software. The software adopts modular development and supports a variety of classification methods, using it can easily realize the design, development and maintenance of personalized websites. PHPCMS 'phpcms\modules\member\index.php ' has an arbitrary password rese...

LEPTON 2.2.2 - Remote Code Execution

LEPTON 2.2.2 - Remote Code Execution Security Advisory - Curesec Research Team 1. Introduction Affected Product: LEPTON 2.2.2 stable Fixed in: 2.3.0 Fixed Version Link: http://www.lepton-cms.org/posts/important-lepton-2.3.0-101.php Vendor Website: http://www.lepton-cms.org/ Vulnerability Type: Co...

DornCMS v1.4 - (FileManager) Persistent XSS Vulnerability

Document Title: =============== DornCMS v1.4 - FileManager Persistent XSS Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1885 Release Date: ============= 2016-07-25 Vulnerability Laboratory ID VL-ID: ==================================== 18...

PivotX 2.3.11 Directory Traversal

Security Advisory - Curesec Research Team 1. Introduction Affected Product: PivotX 2.3.11 Fixed in: not fixed Fixed Version Link: n/a Vendor Website: http://pivotx.net/ Vulnerability Type: Directory Traversal Remote Exploitable: Yes Reported to vendor: 01/20/2016 Disclosed to public: 03/15/2016...

Grawlix 1.0.3 - Cross-Site Request Forgery

Grawlix 1.0.3 - Cross-Site Request Forgery Security Advisory - Curesec Research Team 1. Introduction Affected Product: Grawlix 1.0.3 Fixed in: not fixed Fixed Version Link: n/a Vendor Website: http://www.getgrawlix.com/ Vulnerability Type: CSRF Remote Exploitable: Yes Reported to vendor: 11/17/20...

Grawlix 1.0.3 - Cross-Site Request Forgery

Security Advisory - Curesec Research Team 1. Introduction Affected Product: Grawlix 1.0.3 Fixed in: not fixed Fixed Version Link: n/a Vendor Website: http://www.getgrawlix.com/ Vulnerability Type: CSRF Remote Exploitable: Yes Reported to vendor: 11/17/2015 Disclosed to public: 12/21/2015 Release...