CVE-2022-24744

CVE-2022-24744 – Shopware Affected: Shopware (open commerce platform based on Symfony and Vue) where, in affected versions, user sessions remain active after a password reset via the recovery flow. Root cause (as described in security docs): insufficient session expiration management allowing a u...

CVE-2022-24745 Guest session is shared between customers in shopware

Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions guest sessions are shared between customers when HTTP cache is enabled. This can lead to inconsistent experiences for guest users. Setups with Varnish are not affected b...

CVE-2022-24745

CVE-2022-24745 affects Shopware (Shopware platform) when HTTP caching is enabled. The issue allows guest sessions to be shared between customers due to improper handling of HTTP cache headers in affected versions (Varnish setups are not affected). Root cause is related to caching behavior that ex...

BossCMS V1.1 Arbitrary File Download Vulnerability in Background

BossCMS is a safe, stable, good, permanent free open source, independent research and development of PHP framework for enterprise building system. BossCMS background arbitrary file download vulnerability, attackers can use the vulnerability to download any file in the server...

BossCMS suffers from an arbitrary file upload vulnerability (CNVD-2022-25692)

BossCMS is a safe, stable, good, permanent free open source, independent research and development of PHP framework for enterprise building system. BossCMS arbitrary file upload vulnerability can be exploited by attackers to gain control of the server...

Input validation

Octobercms is a self-hosted CMS platform based on the Laravel PHP Framework. Affected versions of OctoberCMS did not validate gateway server signatures. As a result non-authoritative gateway servers may be used to exfiltrate user private keys. Users are advised to upgrade their installations to...

CVE-2022-23655 Missing server signature validation in OctoberCMS

Octobercms is a self-hosted CMS platform based on the Laravel PHP Framework. Affected versions of OctoberCMS did not validate gateway server signatures. As a result non-authoritative gateway servers may be used to exfiltrate user private keys. Users are advised to upgrade their installations to...

CVE-2022-23655

CVE-2022-23655 affects Octobercms (Laravel-based) where affected versions did not validate gateway server signatures. This allows non-authoritative gateway servers to exfiltrate user private keys. The fix is available via upgrading to build 474 or v1.1.10, or applying the patch commit e3b455ad587...

CVE-2022-21705

October CMS (Laravel-based) is vulnerable to an authenticated remote code execution due to improper sanitization of user input in admin pages, allowing bypass of cms.safe_mode/cms.enableSafeMode and arbitrary code execution. Affected builds were fixed in Build 474 (1.0.474) and 1.1.10; manual rem...

CVE-2022-21705 Authenticated remote code execution in octobercms

Octobercms is a self-hosted CMS platform based on the Laravel PHP Framework. In affected versions user input was not properly sanitized before rendering. An authenticated user with the permissions to create, modify and delete website pages can exploit this vulnerability to bypass cms.safemode /...

Command Execution Vulnerability in BossCMS of Wenzhou Huyin Information Technology Co. Ltd (CNVD-2022-20212)

BossCMS is a content management system based on self-developed PHP framework MySQL architecture developed by Wenzhou Huyin Information Technology Co. A command execution vulnerability exists in BossCMS, which can be exploited by attackers to gain server privileges...

XSS Vulnerability in BossCMS of Wenzhou Huyin Information Technology Co. Ltd (CNVD-2022-21727)

BossCMS is a content management system based on self-developed PHP framework MySQL architecture developed by Wenzhou Huyin Information Technology Co. There is an XSS vulnerability in BossCMS, which can be exploited by attackers to obtain sensitive information such as user cookies...

Command Execution Vulnerability in BossCMS of Wenzhou Huyin Information Technology Co.

BossCMS is a content management system based on self-developed PHP framework MySQL architecture developed by Wenzhou Huyin Information Technology Co. A command execution vulnerability exists in BossCMS, which can be exploited to gain server privileges...

Arbitrary File Deletion Vulnerability in BossCMS of Wenzhou Huanxin Information Technology Company Limited (CNVD-2022-21723)

BossCMS is a content management system based on self-developed PHP framework MySQL architecture developed by Wenzhou Huyin Information Technology Co. BossCMS has an arbitrary file deletion vulnerability, which can be exploited to delete any file on the server...

XSS Vulnerability in BossCMS of Wenzhou Huyin Information Technology Co.

BossCMS is a content management system based on self-developed PHP framework MySQL architecture developed by Wenzhou Huyin Information Technology Co. There is an XSS vulnerability in BossCMS, which can be exploited by attackers to obtain sensitive information such as user cookies...

Arbitrary File Deletion Vulnerability in BossCMS

BossCMS is a content management system based on self-developed PHP framework + MySQL architecture. BossCMS has an arbitrary file deletion vulnerability that can be exploited by an attacker to delete arbitrary files...

Cross site request forgery (csrf)

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The Symfony form component provides a CSRF protection mechanism by using a random token injected in the form and using the session to store and control the token submitted by the user. When using the...

CVE-2022-23601 CSRF token missing in Symfony

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The Symfony form component provides a CSRF protection mechanism by using a random token injected in the form and using the session to store and control the token submitted by the user. When using the...

CVE-2022-23601

CVE-2022-23601 affects the Symfony form component (FrameworkBundle) where CSRF protection was not enabled by default after a configuration-loading change. This made applications vulnerable to CSRF attacks when the default was not explicitly enabled. The issue is resolved in patch versions; users ...

CVE-2021-32650

October CMS is a self-hosted content management system CMS platform based on the Laravel PHP Framework. Prior to versions 1.0.473 and 1.1.6, an attacker with access to the backend is able to execute PHP code by using the theme import feature. This will bypass the safe mode feature that prevents P...