91 matches found
CVE-2022-41473
RPCMS 3.0.2 contains a reflected Cross-Site Scripting (XSS) vulnerability in the Search function. An attacker can inject arbitrary script in the victim’s browser, potentially stealing cookie-based credentials and enabling additional browser-based attacks. Affected product: RPCMS 3.0.2; vulnerabil...
RPCMS Cross-Site Scripting Vulnerabilities
RPCMS is a software application. A website CMS system. A security vulnerability exists in RPCMS version v3.0.2 that stems from the inclusion of reflected cross-site scripting XSS in the search function...
PT-2022-25881
Name of the Vulnerable Software and Affected Versions RPCMS version 3.0.2 Description The issue allows attackers to arbitrarily change the password of any account due to a Cross-Site Request Forgery CSRF. This means an attacker can trick a user into performing unintended actions on the web...
CVE-2022-41474
RPCMS v3.0.2 was discovered to contain a Cross-Site Request Forgery CSRF which allows attackers to arbitrarily change the password of any account...
CVE-2022-41475
RPCMS v3.0.2 was discovered to contain a Cross-Site Request Forgery CSRF which allows attackers to arbitrarily add an administrator account...
CVE-2022-41475
RPCMS v3.0.2 is affected by a Cross-Site Forgery (CSRF) vulnerability that allows attackers to arbitrarily add an administrator account. The incident is documented across multiple sources (NVD CVE-2022-41475, Red Hat, PRion, CNNVD, CVE listings) with a common description. The CVSS v3.1 base score...
PT-2022-25882
Name of the Vulnerable Software and Affected Versions RPCMS version 3.0.2 Description The issue allows attackers to arbitrarily add an administrator account due to a Cross-Site Request Forgery CSRF. This can be exploited by attackers to gain unauthorized access to the system. Recommendations For...
RPCMS Cross-Site Request Forgery Vulnerability
RPCMS is a software application. A website CMS system. A security vulnerability exists in RPCMS version v3.0.2 that stems from allowing an attacker to arbitrarily add administrator accounts...
CVE-2022-41475: Cross-Site Request Forgery (CSRF)
RPCMS v3.0.2 was discovered to contain a Cross-Site Request Forgery CSRF which allows attackers to arbitrarily add an administrator account...
CVE-2022-41474: Cross-Site Request Forgery (CSRF)
RPCMS v3.0.2 was discovered to contain a Cross-Site Request Forgery CSRF which allows attackers to arbitrarily change the password of any account...
SQL Injection Vulnerability in RPCMS (CNVD-2022-64528)
RPCMS is a lightweight content management/blogging system based on PHP MYSQL. RPCMS suffers from a SQL injection vulnerability. An attacker can exploit the vulnerability to obtain sensitive database information...
SQL injection vulnerability exists in RPCMS (CNVD-2022-64953)
RPCMS is a lightweight content management/blogging system based on PHP MYSQL.RPCMS is vulnerable to SQL injection, which can be exploited by attackers to obtain sensitive database information...
SQL injection vulnerability exists in RPCMS (CNVD-2022-61944)
RPCMS is a lightweight content management/blogging system based on PHP MYSQL.RPCMS is vulnerable to SQL injection, which can be exploited by attackers to obtain sensitive database information...
RPCMS has information leakage vulnerability
RPCMS is a lightweight content management/blogging system based on PHP MYSQL.RPCMS has an information disclosure vulnerability that can be exploited by attackers to obtain sensitive information...
RPCMS Cross-Site Scripting Vulnerability (CNVD-2021-61418)
RPCMS is a software application, a web CMS system. RPCMS suffers from a cross-site scripting vulnerability that stems from a failure to properly clean up the nickname variable before it is displayed on a page in RPCMS v1.8 versions and below. With the API functionality turned on, an attacker can...
CVE-2021-37392
In RPCMS v1.8 and below, the "nickname" variable is not properly sanitized before being displayed on page. When the API functions are enabled, the attacker can use API to update user nickname with XSS payload and achieve stored XSS. Users who view the articles published by the injected user will...
CVE-2021-37393
In RPCMS v1.8 and below, the "nickname" variable is not properly sanitized before being displayed on page. Attacker can use "update password" function to inject XSS payloads into nickname variable, and achieve stored XSS. Users who view the articles published by the injected user will trigger the...
CVE-2021-37392
In RPCMS v1.8 and below, the "nickname" variable is not properly sanitized before being displayed on page. When the API functions are enabled, the attacker can use API to update user nickname with XSS payload and achieve stored XSS. Users who view the articles published by the injected user will...
CVE-2021-37393
In RPCMS v1.8 and below, the "nickname" variable is not properly sanitized before being displayed on page. Attacker can use "update password" function to inject XSS payloads into nickname variable, and achieve stored XSS. Users who view the articles published by the injected user will trigger the...