723 matches found
CVE-2018-16629
panel/uploads/elfl1XA in Subrion CMS v4.2.1 allows XSS via an SVG file with JavaScript in a SCRIPT element...
Arbitrary Code Execution
intelliants/subrion is vulnerable to arbitrary code execution attacks. The vulnerability exists due to the lack of blacklist against .pht or .phar files in /panel/uploads, allowing such files to be uploaded and subsequently executed...
Subrion CMS Arbitrary PHP Code Execution Vulnerability
Subrion CMS is a PHP-based content management system CMS developed by the Subrion team. The system can be integrated into a website and supports a wide range of extensions plug-ins and more. A security vulnerability exists in /panel/uploads in Subrion CMS version 4.2.1, which stems from the failu...
Design/Logic Flaw
/panel/uploads in Subrion CMS 4.2.1 allows remote attackers to execute arbitrary PHP code via a .pht or .phar file, because the .htaccess file omits these...
CVE-2018-19422
/panel/uploads in Subrion CMS 4.2.1 allows remote attackers to execute arbitrary PHP code via a .pht or .phar file, because the .htaccess file omits these...
CVE-2018-19422
CVE-2018-19422 affects Subrion CMS 4.2.1. The root cause is that .htaccess omits .pht and .phar from the blacklist, allowing uploaded files of these types in /panel/uploads to be executed as PHP, enabling remote code execution. Public advisories, exploit-DB entries, and Metasploit module descript...
PT-2018-14956 · Subrion · Subrion Cms
Name of the Vulnerable Software and Affected Versions: Subrion CMS version 4.2.1 Description: The issue allows remote attackers to execute arbitrary PHP code via a .pht or .phar file. This is because the .htaccess file omits these file types, specifically affecting the /panel/uploads endpoint...
CVE-2018-19422
/panel/uploads in Subrion CMS 4.2.1 allows remote attackers to execute arbitrary PHP code via a .pht or .phar file, because the .htaccess file omits these...
Intelliants Subrion CMS 4.2.1 - Authenticated File Upload Bypass to RCE
This module exploits an authenticated file upload vulnerability in Subrion CMS versions 4.2.1 and lower. The vulnerability is caused by the .htaccess file not preventing the execution of .pht, .phar, and .xhtml files. Files with these extensions are not included in the .htaccess blacklist, hence...
Cross-Site Scripting (XSS)
intelliants/subrion is vulnerable to cross-site scripting. An attacker is able to inject arbitrary Javascript into a victim's browser via the titlesen parameter in core/admin/pages/add/ to steal session cookies or perform unwanted actions on behalf of the user...
Design/Logic Flaw
core/admin/pages/add/ in Subrion CMS 4.2.1 has XSS via the titlesen parameter...
CVE-2018-15563
core/admin/pages/add/ in Subrion CMS 4.2.1 has XSS via the titlesen parameter...
CVE-2018-15563
core/admin/pages/add/ in Subrion CMS 4.2.1 has XSS via the titlesen parameter...
CVE-2018-15563
The CVE-2018-15563 entry concerns Subrion CMS 4.2.1 with a Stored XSS vulnerability in the _core/admin/pages/add/ path, exploitable via the titles[en] parameter. The root cause is improper handling/sanitization of user-supplied input in the page title field, allowing injection of JavaScript that ...
CVE-2018-15563
core/admin/pages/add/ in Subrion CMS 4.2.1 has XSS via the titlesen parameter...
Subrion cross-site scripting vulnerability (CNVD-2018-19084)
Subrion is a PHP-based content management system CMS developed by the Subrion team. The system can be integrated into a website and supports a variety of extensions plug-ins and more. A cross-site scripting vulnerability exists in Subrion version 4.2.1, which can be exploited by remote attackers ...
Cross-Site Scripting (XSS)
intelliants/subrion is susceptible to cross-site scripting XSS. The vulnerability exists because it does not properly validate the admin panel URL configuration...
CVE-2018-16327
There is Stored XSS in Subrion 4.2.1 via the admin panel URL configuration...