167 matches found
CVE-2020-20348: Improper Neutralization of Input During Web Page Generation
WTCMS 1.0 contains a stored cross-site scripting XSS vulnerability in the link field under the background menu management module...
WTCMS 跨站脚本漏洞
WTCMS is a content management system CMS based on ThinkPHP. wtcms has a cross-site scripting vulnerability in the article source field under the article management module. No detailed vulnerability details are currently available...
WTCMS Cross-Site Request Forgery Vulnerability (CNVD-2019-34388)
WTCMS is a ThinkPHP-based content management system CMS. A cross-site request forgery vulnerability exists in WTCMS version 1.0, which can be exploited by an attacker to send unintended requests to the server via an affected client...
CVE-2019-16719
WTCMS 1.0 allows index.php?g=admin&m=index&a=index CSRF with resultant XSS...
CVE-2019-16719
WTCMS 1.0 allows index.php?g=admin&m=index&a=index CSRF with resultant XSS...
Cross site request forgery (csrf)
WTCMS 1.0 allows index.php?g=admin&m=index&a=index CSRF with resultant XSS...
CVE-2019-16719
WTCMS 1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability that can result in a stored/ reflected XSS when accessing index.php?g=admin&m=index&a=index. The CVE description and multiple connected sources confirm the issue as a CSRF leading to XSS; however, the provided documents do not i...
PT-2019-14791
Name of the Vulnerable Software and Affected Versions WTCMS version 1.0 Description The issue allows for a CSRF attack with resultant XSS via the index.php endpoint, specifically when accessing the g=admin&m=index&a=index parameters. This can lead to unauthorized actions being performed on the...
CVE-2019-16719: Improper Neutralization of Input During Web Page Generation
WTCMS 1.0 allows index.php?g=admin&m=index&a=index CSRF with resultant XSS...
WTCMS Arbitrary PHP Code Execution Vulnerability
WTCMS is a ThinkPHP-based content management system CMS. An arbitrary PHP code execution vulnerability exists in WTCMS version 1.0, which can be exploited by remote attackers to execute PHP code by uploading an image file with the help of the registration email template page in the email settings...
WTCMS Cross-Site Request Forgery Vulnerability (CNVD-2019-04684)
WTCMS is a ThinkPHP-based content management system CMS. A cross-site request forgery vulnerability exists in WTCMS version 1.0, which can be exploited by remote attackers to alter website information...
CVE-2019-8911
An issue was discovered in WTCMS 1.0. It has stored XSS via the third text box for the website statistics code...
CVE-2019-8908
An issue was discovered in WTCMS 1.0. It allows remote attackers to execute arbitrary PHP code by going to the "Setting - Mailbox configuration - Registration email template" screen, and uploading an image file, as demonstrated by a .php filename and the "Content-Type: image/gif" header...
CVE-2019-8909
An issue was discovered in WTCMS 1.0. It allows remote attackers to cause a denial of service resource consumption via crafted dimensions for the verification code image...
CVE-2019-8910
An issue was discovered in WTCMS 1.0. It allows index.php?g=admin&m=setting&a=sitepost CSRF...
Cross site scripting
An issue was discovered in WTCMS 1.0. It has stored XSS via the third text box for the website statistics code...
Design/Logic Flaw
An issue was discovered in WTCMS 1.0. It allows remote attackers to execute arbitrary PHP code by going to the "Setting - Mailbox configuration - Registration email template" screen, and uploading an image file, as demonstrated by a .php filename and the "Content-Type: image/gif" header...
CVE-2019-8909
An issue was discovered in WTCMS 1.0. It allows remote attackers to cause a denial of service resource consumption via crafted dimensions for the verification code image...
CVE-2019-8908
An issue was discovered in WTCMS 1.0. It allows remote attackers to execute arbitrary PHP code by going to the "Setting - Mailbox configuration - Registration email template" screen, and uploading an image file, as demonstrated by a .php filename and the "Content-Type: image/gif" header...