102 matches found
CVE-2024-42758
CVE-2024-42758 Dokuwiki오픈 소스 위키 엔진에서 indexmenu 플러그인이 사용 및 활성화된 v2024-01-05 버전에 교차 사이트 스크립팅XSS 취약점이 존재합니다. 악의적인 공격자는 예를 들어 기존 페이지를 생성하거나 편집할 때 XSS 페이로드를 입력하여 Dokuwiki에서 XSS를 트리거할 수 있으며, 이는 Dokuwiki 설계의 특성상 .txt 파일에 저장되어 저장형 XSS를 발생시킵니다. https://vulners.com/cve/CVE-2024-42758 취약한 Dokuwiki 페이지:...
CVE-2026-71426: Improper Limitation of a Pathname to a Restricted Directory
GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. In versions 3.3.22 and prior, an authenticated user with page-editing rights can store an arbitrary filesystem path in a page's template attribute. On the public front-end, this value is...
CVE-2026-81919
Concrete CMS below 9.5.3 did not validate an anti-CSRF token on the block-arrangement backend endpoint the arrange action of Concrete\Controller\Backend\Page\ArrangeBlocks. The action enforced page-edit authorization but performed no token check, and its route accepted any HTTP method, so an...
CVE-2026-45572: Improper Control of Generation of Code
Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, an administrator with landing-page editing privileges can store arbitrary HTML and JavaScript in an HTML content block, which Decidim::ContentBlocks::HtmlCellhtmlconten...
EUVD-2026-50988
The Sync Post With Other Site WordPress plugin before 1.9.3 does not correctly enforce the page-editing capability on a REST route that creates and updates posts, because of an operator-precedence flaw in its authorization check. An authenticated user holding only the post-editing capability such...
CVE-2026-42841
Grav is a file-based Web platform. Prior to 2.0.0-beta.2, an authenticated user with page editing permissions can inject an executable JavaScript event-handler attribute into rendered image HTML through Grav's Markdown media action syntax. The issue is caused by Markdown image query parameters...
CVE-2026-42841 Grav: Stored XSS via Markdown media attribute() action in Grav CMS
Grav is a file-based Web platform. Prior to 2.0.0-beta.2, an authenticated user with page editing permissions can inject an executable JavaScript event-handler attribute into rendered image HTML through Grav's Markdown media action syntax. The issue is caused by Markdown image query parameters...
Cross-site Scripting (XSS)
Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Cross-site Scripting XSS in the attribute process. An attacker can execute arbitrary JavaScript in the context of users who view a page by...
PT-2026-37280
Name of the Vulnerable Software and Affected Versions Grav versions prior to 2.0.0-beta.2 Description An authenticated user with page editing permissions can perform stored Cross-Site Scripting XSS by injecting an executable JavaScript event-handler attribute into rendered image HTML. This occurs...
RiteCMS 3.1.0 - Authenticated Remote Code Execution
Exploit Title: RiteCMS 3.1.0 - Authenticated Remote Code Execution Date: 2025-10-26 Exploit Author: Chokri Hammedi Vendor Homepage: https://github.com/handylulu/RiteCMS Software Link: https://github.com/handylulu/RiteCMS/releases/download/V3.1.0/ritecms.v3.1.0.zip Version: 3.1.0 Tested on: Window...
EUVD-2026-16553
WordPress Plugin "OpenStreetMap" provided by MiKa contains a cross-site scripting vulnerability. On the site with the affected version of the plugin enabled, a logged-in user with a page-creating/editing privilege can embed some malicious script with a crafted HTTP request. When a victim user...
WordPress plugin OpenStreetMap 跨站脚本漏洞
WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. The...
EUVD-2026-12552
The extension fails to verify, if an authenticated user has permissions to access to redirects resulting in exposure of redirect records when editing a page...
GHSA-755R-R738-MJGP Broken Access Control in extension "Redirect Tab" (redirect_tab)
The extension fails to verify, if an authenticated user has permissions to access to redirects resulting in exposure of redirect records when editing a page...
Broken Access Control in extension "Redirect Tab" (redirect_tab)
The extension fails to verify, if an authenticated user has permissions to access to redirects resulting in exposure of redirect records when editing a page...
CVE-2026-4202
The extension fails to verify, if an authenticated user has permissions to access to redirects resulting in exposure of redirect records when editing a page...
CVE-2026-4202 Broken Access Control in extension "Redirect Tab"
The extension fails to verify, if an authenticated user has permissions to access to redirects resulting in exposure of redirect records when editing a page...
TYPO3 Extension Redirect Tabs 安全漏洞
TYPO3 Extension Redirect Tabs is a page redirection tool developed by Guido Schmechel. TYPO3 Extension Redirect Tabs has a security vulnerability; this vulnerability arises from the extension failing to verify whether the authenticated user has permission to access the redirection, which may lead...
RiteCMS Cross-Site Request Forgery Vulnerability
RiteCMS is an open source content management system based on php and sqlite. RiteCMS has a cross-site request forgery vulnerability, the vulnerability stems from the page creation and editing functions do not adequately verify whether the request comes from a trusted user, an attacker can use thi...
