CVE-2017-6068

Subrion CMS 4.0.5 has CSRF in admin/blocks/add/. The attacker can create any block, and can optionally insert XSS via the content parameter...

CVE-2017-6002

Subrion CMS 4.0.5.10 has CSRF in admin/blog/add/. The attacker can add any blog entry, and can optionally insert XSS into that entry via the body parameter...

CVE-2017-6068

Subrion CMS 4.0.5 has CSRF in admin/blocks/add/. The attacker can create any block, and can optionally insert XSS via the content parameter...

CVE-2017-6013

Subrion CMS 4.0.5.10 has SQL injection in admin/database/ via the query parameter...

CVE-2017-6066

Subrion CMS 4.0.5 has CSRF in admin/languages/edit/1/. The attacker can perform any Edit Language action, and can optionally insert XSS via the title parameter...

CVE-2017-6069

Subrion CMS 4.0.5 has CSRF in admin/blog/add/. The attacker can add any tag, and can optionally insert XSS via the tags parameter...

CVE-2017-6066

Subrion CMS 4.0.5 has CSRF in admin/languages/edit/1/. The attacker can perform any Edit Language action, and can optionally insert XSS via the title parameter...

CVE-2017-6002

Subrion CMS 4.0.5.10 has CSRF in admin/blog/add/. The attacker can add any blog entry, and can optionally insert XSS into that entry via the body parameter...

CVE-2017-6066

Subrion CMS 4.0.5 has CSRF in admin/languages/edit/1/. The attacker can perform any Edit Language action, and can optionally insert XSS via the title parameter...

CVE-2017-6068

Subrion CMS 4.0.5 has CSRF in admin/blocks/add/. The attacker can create any block, and can optionally insert XSS via the content parameter...

CVE-2017-6069

Subrion CMS 4.0.5 has CSRF in admin/blog/add/. The attacker can add any tag, and can optionally insert XSS via the tags parameter...

CVE-2017-6013

Subrion CMS 4.0.5.10 is affected by an SQL injection in the admin/database/ URI via the query parameter. The vulnerability enables arbitrary SQL execution (impact: confidentiality, integrity, and availability can be affected). Documented in NVD/CNVD entries for CVE-2017-6013; no patch/version rem...

CVE-2017-6066

Subrion CMS 4.0.5 has a CSRF vulnerability in the admin/languages/edit/1/ endpoint. An attacker can perform any Edit Language action and may inject XSS via the title parameter. This issue is consistently described across multiple sources (NVD/CNVD/OSV) with the same details. No remediation steps ...

CVE-2017-6068

Subrion CMS 4.0.5 is affected by a CSRF flaw in admin/blocks/add/ that allows an attacker to create blocks and potentially inject XSS through the content parameter. The root cause is a CSRF vulnerability in the block-creation endpoint; exploitation details and whether an in-the-wild exploit exist...

CVE-2017-6069

Subrion CMS 4.0.5 is affected by CVE-2017-6069: CSRF in admin/blog/add/ can let an attacker add arbitrary tags and may allow XSS via the tags parameter. Connected records also describe a separate XSS vulnerability (via the blog/add/ body) that is a different issue from CVE-2017-6069. The CVE desc...

CVE-2017-6013

Subrion CMS 4.0.5.10 has SQL injection in admin/database/ via the query parameter...

CVE-2017-6002

Subrion CMS 4.0.5.10 is affected by a Cross-Site Request Forgery (CSRF) vulnerability in admin/blog/add/. An attacker can exploit CSRF to add arbitrary blog entries and may inject XSS into the created entry via the body parameter. The vulnerability is documented in multiple sources (e.g., CNVD-20...

PT-2017-16876

Name of the Vulnerable Software and Affected Versions Subrion CMS version 4.0.5 Description The issue allows an attacker to perform a CSRF attack on the "admin/blocks/add/" endpoint, enabling them to create any block. Additionally, the attacker can optionally insert XSS via the content parameter...

PT-2017-16877

Name of the Vulnerable Software and Affected Versions Subrion CMS version 4.0.5 Description The issue allows an attacker to perform a CSRF attack on the "admin/blog/add/" endpoint, enabling them to add any tag. Additionally, the attacker can optionally insert XSS via the tags parameter...

CVE-2017-6002: Cross-Site Request Forgery (CSRF)

Subrion CMS 4.0.5.10 has CSRF in admin/blog/add/. The attacker can add any blog entry, and can optionally insert XSS into that entry via the body parameter...