PopojiCMS Cross-Site Scripting Vulnerability

PopojiCMS is an open source content management system CMS based on the Popoji framework. A cross-site scripting vulnerability exists in PopojiCMS. The vulnerability stems from a lack of proper validation of client-side data in the WEB application. An attacker can exploit this vulnerability to...

CVE-2019-18816

po-admin/route.php?mod=post&act=edit in PopojiCMS 2.0.1 allows post1content= stored XSS...

CVE-2019-18816

po-admin/route.php?mod=post&act=edit in PopojiCMS 2.0.1 allows post1content= stored XSS...

CVE-2019-18815

PopojiCMS 2.0.1 allows refer= Open Redirection...

CVE-2019-18815

PopojiCMS 2.0.1 allows refer= Open Redirection...

Open redirect

PopojiCMS 2.0.1 allows refer= Open Redirection...

Cross site scripting

po-admin/route.php?mod=post&act=edit in PopojiCMS 2.0.1 allows post1content= stored XSS...

CVE-2019-18815

PopojiCMS 2.0.1 is affected by an Open Redirect vulnerability driven by improper handling of the refer parameter. The issue allows redirection to arbitrary URLs, potentially aiding phishing or user-tracking scenarios. No explicit exploit details, patches, or version-specific remediations are prov...

CVE-2019-18815

PopojiCMS 2.0.1 allows refer= Open Redirection...

CVE-2019-18816

PopojiCMS 2.0.1 is affected by a stored XSS in po-admin/route.php?mod=post&act=edit, exploitable via post[1][content]. Multiple connected sources (NVD, Red Hat, CNVD, OSV, CVE lists) confirm the vulnerability, citing lack of input validation in the admin route. Impacted component is the post cont...

CVE-2019-18816

po-admin/route.php?mod=post&act=edit in PopojiCMS 2.0.1 allows post1content= stored XSS...

Cross site request forgery (csrf)

An issue was discovered in PopojiCMS v2.0.1. It has CSRF via the po-admin/route.php?mod=user&act=addnew URI, as demonstrated by adding a level=1 account, a similar issue to CVE-2018-18935...

CVE-2019-9549

An issue was discovered in PopojiCMS v2.0.1. It has CSRF via the po-admin/route.php?mod=user&act=addnew URI, as demonstrated by adding a level=1 account, a similar issue to CVE-2018-18935...

CVE-2019-9549

An issue was discovered in PopojiCMS v2.0.1. It has CSRF via the po-admin/route.php?mod=user&act=addnew URI, as demonstrated by adding a level=1 account, a similar issue to CVE-2018-18935...

CVE-2019-9549

An issue was discovered in PopojiCMS v2.0.1. It has CSRF via the po-admin/route.php?mod=user&act=addnew URI, as demonstrated by adding a level=1 account, a similar issue to CVE-2018-18935...

CVE-2019-9549

CVE-2019-9549 affects PopojiCMS v2.0.1 with a CSRF via po-admin/route.php?mod=user&act=addnew that can enable creation of an unauthorized level-1 account. CVSSv2 base 6.8 (MEDIUM) and CVSSv3 base 8.8 (HIGH) are noted. No remediation details are provided in the connected documents; exploitation st...

PopojiCMS Cross-Site Request Forgery Vulnerability

PopojiCMS is an open source content management system CMS based on the Popoji framework. A cross-site request forgery vulnerability exists in the po-admin/route.php?mod=component&act=addnew URI in PopojiCMS v2.0.1. A remote attacker can exploit this vulnerability to perform unauthorized operation...

PopojiCMS Directory Traversal Vulnerability

PopojiCMS is an open source content management system CMS based on the Popoji framework. A directory traversal vulnerability exists in the adminlibrary.php file in PopojiCMS v2.0.1. A remote attacker can exploit this vulnerability to delete arbitrary files with the help of specially crafted...

CVE-2018-18935

An issue was discovered in PopojiCMS v2.0.1. It has CSRF via the po-admin/route.php?mod=component&act=addnew URI, as demonstrated by adding a level=1 account...

Cross site request forgery (csrf)

An issue was discovered in PopojiCMS v2.0.1. admincomponent.php is exploitable via the po-admin/route.php?mod=component&act=addnew URI by using the fupload parameter to upload a ZIP file containing arbitrary PHP code that is extracted and can be executed. This can also be exploited via CSRF...