PT-2024-13668

Name of the Vulnerable Software and Affected Versions CU Solutions Group CUSG Content Management System CMS versions prior to 7.75 Description A Cross Site Scripting XSS issue allows a remote attacker to execute arbitrary code, escalate privileges, and obtain sensitive information via a crafted...

CVE-2023-48987: Improper Neutralization of Special Elements used in an SQL Command

Blind SQL Injection vulnerability in CU Solutions Group CUSG Content Management System CMS before v.7.75 allows a remote attacker to execute arbitrary code, escalate privileges, and obtain sensitive information via a crafted script to the pages.php component...

CVE-2023-3527: Improper Neutralization of Formula Elements in a CSV File

A CSV injection vulnerability was found in the Avaya Call Management System CMS Supervisor web application which allows a user with administrative privileges to input crafted data which, when exported to a CSV file, may attempt arbitrary command execution on the system used to open the file by a...

PT-2023-25199

Name of the Vulnerable Software and Affected Versions Avaya Call Management System CMS Supervisor affected versions not specified Description A CSV injection issue was found in the Avaya Call Management System CMS Supervisor web application, allowing a user with administrative privileges to input...

[SECURITY] Fedora 36 Update: moodle-3.11.10-1.fc36

Moodle is a course management system CMS - a free, Open Source software package designed using sound pedagogical principles, to help educators create effective online learning communities...

PT-2018-15453

Name of the Vulnerable Software and Affected Versions Ivan Cordoba Generic Content Management System CMS through 2018-04-28 Description The issue concerns a Cross-Site Scripting XSS flaw. It is exploitable via the Administrator/add pictures.php article ID. Recommendations For Ivan Cordoba Generic...

CVE-2018-20590: Improper Neutralization of Input During Web Page Generation

Ivan Cordoba Generic Content Management System CMS through 2018-04-28 has XSS via the Administrator/users.php user ID...

CVE-2018-20589: Improper Neutralization of Input During Web Page Generation

Ivan Cordoba Generic Content Management System CMS through 2018-04-28 has XSS via the Administrator/addpictures.php article ID...

PT-2018-15454

Name of the Vulnerable Software and Affected Versions Ivan Cordoba Generic Content Management System CMS through 2018-04-28 Description The issue allows for XSS via the Administrator/users.php user ID. Recommendations For Ivan Cordoba Generic Content Management System CMS through 2018-04-28, avoi...

CVE-2018-20568: Improper Neutralization of Special Elements used in an SQL Command

Administrator/index.php in Ivan Cordoba Generic Content Management System CMS through 2018-04-28 allows SQL injection for authentication bypass...

PT-2018-15439

Name of the Vulnerable Software and Affected Versions Ivan Cordoba Generic Content Management System CMS versions through 2018-04-28 Description The issue allows for SQL injection, which can be used for authentication bypass. This means an attacker could potentially gain unauthorized access to th...

Shipping System CMS SQL Injection Vulnerability

Shipping System CMS is a shipping management system. Shipping System CMS suffers from a SQL injection vulnerability. An attacker can exploit this vulnerability to execute arbitrary SQL statements...

PT-2017-14339

Name of the Vulnerable Software and Affected Versions Creative Management System CMS Lite version 1.4 Description The issue allows SQL Injection via the S parameter to the "index.php" endpoint. Recommendations For Creative Management System CMS Lite version 1.4, consider restricting access to the...

CVE-2017-15984: Improper Neutralization of Special Elements used in an SQL Command

Creative Management System CMS Lite 1.4 allows SQL Injection via the S parameter to index.php...

PT-2017-5207

Name of the Vulnerable Software and Affected Versions: Ektron Content Management System CMS versions prior to 8.02 SP5 Description: The issue allows remote attackers to execute arbitrary code with NETWORK SERVICE privileges via crafted XSL data, due to the use of the XslCompiledTransform class wi...

CVE-2012-5357: Undefined Security Weakness

Ektron Content Management System CMS before 8.02 SP5 uses the XslCompiledTransform class with enablescript set to true, which allows remote attackers to execute arbitrary code with NETWORK SERVICE privileges via crafted XSL data...

CVE-2012-5358: Undefined Security Weakness

The XSLTCompiledTransform function in Ektron Content Management System CMS before 8.02 SP5 configures the XSL with enableDocumentFunction set to true, which allows remote attackers to read arbitrary files and consequently bypass authentication, modify viewstate, cause a denial of service, or...

CVE-2016-6201: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Ektron Content Management System CMS before 9.1.0.184 SP3 9.1.0.184.3.127 allows remote attackers to inject arbitrary web script or HTML via the ContType parameter in a ViewContentByCategory action to WorkArea/content.aspx...

CVE-2015-3624: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in Test/WorkArea/DmsMenu/menuActions/MenuActions.aspx in Ektron Content Management System CMS before 9.10 SP1 Build 9.1.0.184.1.120 allows remote attackers to hijack the authentication of content administrators for requests that delete content via a...

CVE-2015-4427: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Test/WorkArea/workarea.aspx in Ektron Content Management System CMS before 9.10 SP1 Build 9.1.0.184.1.114 allow remote authenticated users to inject arbitrary web script or HTML via the 1 page, 2 action, 3 folderid, or 4 LangType parameter...