91 matches found
CVE-2026-81919
Concrete CMS below 9.5.3 did not validate an anti-CSRF token on the block-arrangement backend endpoint the arrange action of Concrete\Controller\Backend\Page\ArrangeBlocks. The action enforced page-edit authorization but performed no token check, and its route accepted any HTTP method, so an...
CVE-2024-42758
CVE-2024-42758 indexmenu 插件在 Dokuwiki（开源 Wiki 引擎）中启用并使用的情况下，其 v2024-01-05 版本存在跨站脚本（XSS）漏洞。恶意攻击者可以在创建或编辑现有页面时输入 XSS 载荷，从而触发 Dokuwiki 上的 XSS，该载荷会存储在 .txt 文件中（由于 Dokuwiki 的设计特性），表现为存储型 XSS。 https://vulners.com/cve/CVE-2024-42758 受影响的 Dokuwiki 页面：doku.php?id=pagename 易受攻击的载荷： 由 Antun Matija Kriskovic...
EUVD-2026-50988
The Sync Post With Other Site WordPress plugin before 1.9.3 does not correctly enforce the page-editing capability on a REST route that creates and updates posts, because of an operator-precedence flaw in its authorization check. An authenticated user holding only the post-editing capability such...
CVE-2026-42841
Grav is a file-based Web platform. Prior to 2.0.0-beta.2, an authenticated user with page editing permissions can inject an executable JavaScript event-handler attribute into rendered image HTML through Grav's Markdown media action syntax. The issue is caused by Markdown image query parameters...
CVE-2026-42841 Grav: Stored XSS via Markdown media attribute() action in Grav CMS
Grav is a file-based Web platform. Prior to 2.0.0-beta.2, an authenticated user with page editing permissions can inject an executable JavaScript event-handler attribute into rendered image HTML through Grav's Markdown media action syntax. The issue is caused by Markdown image query parameters...
Cross-site Scripting (XSS)
Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Cross-site Scripting XSS in the attribute process. An attacker can execute arbitrary JavaScript in the context of users who view a page by...
PT-2026-37280
Name of the Vulnerable Software and Affected Versions Grav versions prior to 2.0.0-beta.2 Description An authenticated user with page editing permissions can perform stored Cross-Site Scripting XSS by injecting an executable JavaScript event-handler attribute into rendered image HTML. This occurs...
RiteCMS 3.1.0 - Authenticated Remote Code Execution
Exploit Title: RiteCMS 3.1.0 - Authenticated Remote Code Execution Date: 2025-10-26 Exploit Author: Chokri Hammedi Vendor Homepage: https://github.com/handylulu/RiteCMS Software Link: https://github.com/handylulu/RiteCMS/releases/download/V3.1.0/ritecms.v3.1.0.zip Version: 3.1.0 Tested on: Window...
EUVD-2026-16553
WordPress Plugin "OpenStreetMap" provided by MiKa contains a cross-site scripting vulnerability. On the site with the affected version of the plugin enabled, a logged-in user with a page-creating/editing privilege can embed some malicious script with a crafted HTTP request. When a victim user...
WordPress plugin OpenStreetMap 跨站脚本漏洞
WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. The...
EUVD-2026-12552
The extension fails to verify, if an authenticated user has permissions to access to redirects resulting in exposure of redirect records when editing a page...
GHSA-755R-R738-MJGP Broken Access Control in extension "Redirect Tab" (redirect_tab)
The extension fails to verify, if an authenticated user has permissions to access to redirects resulting in exposure of redirect records when editing a page...
Broken Access Control in extension "Redirect Tab" (redirect_tab)
The extension fails to verify, if an authenticated user has permissions to access to redirects resulting in exposure of redirect records when editing a page...
CVE-2026-4202
The extension fails to verify, if an authenticated user has permissions to access to redirects resulting in exposure of redirect records when editing a page...
CVE-2026-4202 Broken Access Control in extension "Redirect Tab"
The extension fails to verify, if an authenticated user has permissions to access to redirects resulting in exposure of redirect records when editing a page...
TYPO3 Extension Redirect Tabs 安全漏洞
TYPO3 Extension Redirect Tabs is a page redirection tool developed by Guido Schmechel. TYPO3 Extension Redirect Tabs has a security vulnerability; this vulnerability arises from the extension failing to verify whether the authenticated user has permission to access the redirection, which may lead...
RiteCMS Cross-Site Request Forgery Vulnerability
RiteCMS is an open source content management system based on php and sqlite. RiteCMS has a cross-site request forgery vulnerability, the vulnerability stems from the page creation and editing functions do not adequately verify whether the request comes from a trusted user, an attacker can use thi...
CVE-2025-67173
A Cross-Site Request Forgery CSRF in the page creation/editing function of RiteCMS v3.1.0 allows attackers to arbitrarily create pages via a crafted POST request...
EUVD-2025-203915
A Cross-Site Request Forgery CSRF in the page creation/editing function of RiteCMS v3.1.0 allows attackers to arbitrarily create pages via a crafted POST request...
RiteCMS 安全漏洞
RiteCMS is an open source content management system based on php and sqlite. RiteCMS has a cross-site request forgery vulnerability, the vulnerability stems from the page creation and editing functions do not adequately verify whether the request comes from a trusted user, an attacker can use thi...