CVE-2020-20601

An issue in ThinkCMF X2.2.2 and below allows attackers to execute arbitrary code via a crafted packet...

Code injection

An issue in ThinkCMF X2.2.2 and below allows attackers to execute arbitrary code via a crafted packet...

CVE-2020-20601

ThinkCMF X2.2.2 and earlier are affected by CVE-2020-20601, a remote code execution vulnerability caused by processing crafted packets. The nuclei template specifies that unauthenticated attackers can remotely execute arbitrary PHP code on ThinkCMF servers by sending malicious packets, potentiall...

CVE-2020-20601

An issue in ThinkCMF X2.2.2 and below allows attackers to execute arbitrary code via a crafted packet...

ThinkCMF 代码注入漏洞

ThinkCMF is a CMS Content Management System based on ThinkPHP. thinkCMF version X2.2.2 has a security vulnerability that can be exploited by attackers to execute arbitrary code via a crafted package...

PT-2021-10516

Name of the Vulnerable Software and Affected Versions: ThinkCMF versions X2.2.2 and below Description: An issue in ThinkCMF allows attackers to execute arbitrary code via a crafted packet. Recommendations: For ThinkCMF versions X2.2.2 and below, at the moment, there is no information about a newe...

ThinkCMF Cross-site Request Forgery Vulnerability

ThinkCMF is a CMS Content Management System based on ThinkPHP. thinkCMF v5.1.0 is vulnerable to cross-site request forgery, which allows attackers to add administrator accounts. No details of the vulnerability are currently available...

CVE-2020-18151

Cross Site Request Forgery CSRF vulnerability in ThinkCMF v5.1.0, which can add an admin account...

CVE-2020-18151

Cross Site Request Forgery CSRF vulnerability in ThinkCMF v5.1.0, which can add an admin account...

Cross site request forgery (csrf)

Cross Site Request Forgery CSRF vulnerability in ThinkCMF v5.1.0, which can add an admin account...

CVE-2020-18151

ThinkCMF v5.1.0 is affected by a Cross-Site Request Forgery (CSRF) vulnerability that can be abused to add an administrator account. The CVE-2020-18151 entry documents CSRF as the underlying issue without detailing the exact user flow or vulnerable endpoints in the connected sources. The initial ...

CVE-2020-18151

Cross Site Request Forgery CSRF vulnerability in ThinkCMF v5.1.0, which can add an admin account...

PT-2021-10140 · Thinkcmf · Thinkcmf

Name of the Vulnerable Software and Affected Versions: ThinkCMF version 5.1.0 Description: The issue is related to a Cross Site Request Forgery CSRF vulnerability, which can be exploited to add an admin account. This allows an attacker to potentially gain unauthorized access to the system...

ThinkCMF 跨站请求伪造漏洞

ThinkCMF is a CMS Content Management System based on ThinkPHP. thinkCMF v5.1.0 is vulnerable to cross-site request forgery, which allows attackers to add administrator accounts. No details of the vulnerability are currently available...

ThinkCMF ThinkCMFX Remote Code Execution

A remote code execution vulnerability exists in ThinkCMF ThinkCMFX. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

Command Execution Vulnerability in ThinkCMFX

ThinkCMF is a Chinese content management framework based on ThinkPHP+MySQL, of which the X series is based on ThinkPHP 3.2.3. A command execution vulnerability exists in ThinkCMFX, which can be exploited by attackers to execute malicious code...

File upload vulnerability in ThinkCMF frontend Ue***.cl***.php file

ThinkCMF is a Chinese content management framework based on PHP+MYSQL. A file upload vulnerability exists in the ThinkCMF frontend Ue.cl.php file. An attacker can exploit the vulnerability to upload a webshell and gain server privileges...

CVE-2019-7580

ThinkCMF 5.0.190111 allows remote attackers to execute arbitrary PHP code via the portal/admincategory/addpost.html alias parameter because the mishandling of a single quote character allows data/conf/route.php injection...

Design/Logic Flaw

ThinkCMF 5.0.190111 allows remote attackers to execute arbitrary PHP code via the portal/admincategory/addpost.html alias parameter because the mishandling of a single quote character allows data/conf/route.php injection...

CVE-2019-7580

ThinkCMF 5.0.190111 allows remote attackers to execute arbitrary PHP code via the portal/admincategory/addpost.html alias parameter because the mishandling of a single quote character allows data/conf/route.php injection...