167 matches found
WTCMS 跨站脚本漏洞
WTCMS is a content management system CMS based on ThinkPHP. wtcms has a cross-site scripting vulnerability in the article source field under the article management module. No detailed vulnerability details are currently available...
CVE-2020-20343: Cross-Site Request Forgery (CSRF)
WTCMS 1.0 contains a cross-site request forgery CSRF vulnerability in the index.php?g=admin&m=nav&a=addpost component that allows attackers to arbitrarily add articles in the administrator background...
WTCMS Cross-Site Request Forgery Vulnerability (CNVD-2019-34388)
WTCMS is a ThinkPHP-based content management system CMS. A cross-site request forgery vulnerability exists in WTCMS version 1.0, which can be exploited by an attacker to send unintended requests to the server via an affected client...
CVE-2019-16719
WTCMS 1.0 allows index.php?g=admin&m=index&a=index CSRF with resultant XSS...
CVE-2019-16719
WTCMS 1.0 allows index.php?g=admin&m=index&a=index CSRF with resultant XSS...
Cross site request forgery (csrf)
WTCMS 1.0 allows index.php?g=admin&m=index&a=index CSRF with resultant XSS...
CVE-2019-16719
WTCMS 1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability that can result in a stored/ reflected XSS when accessing index.php?g=admin&m=index&a=index. The CVE description and multiple connected sources confirm the issue as a CSRF leading to XSS; however, the provided documents do not i...
PT-2019-14791
Name of the Vulnerable Software and Affected Versions WTCMS version 1.0 Description The issue allows for a CSRF attack with resultant XSS via the index.php endpoint, specifically when accessing the g=admin&m=index&a=index parameters. This can lead to unauthorized actions being performed on the...
CVE-2019-16719: Improper Neutralization of Input During Web Page Generation
WTCMS 1.0 allows index.php?g=admin&m=index&a=index CSRF with resultant XSS...
WTCMS Cross-Site Request Forgery Vulnerability (CNVD-2019-04684)
WTCMS is a ThinkPHP-based content management system CMS. A cross-site request forgery vulnerability exists in WTCMS version 1.0, which can be exploited by remote attackers to alter website information...
WTCMS Arbitrary PHP Code Execution Vulnerability
WTCMS is a ThinkPHP-based content management system CMS. An arbitrary PHP code execution vulnerability exists in WTCMS version 1.0, which can be exploited by remote attackers to execute PHP code by uploading an image file with the help of the registration email template page in the email settings...
CVE-2019-8911
An issue was discovered in WTCMS 1.0. It has stored XSS via the third text box for the website statistics code...
CVE-2019-8908
An issue was discovered in WTCMS 1.0. It allows remote attackers to execute arbitrary PHP code by going to the "Setting - Mailbox configuration - Registration email template" screen, and uploading an image file, as demonstrated by a .php filename and the "Content-Type: image/gif" header...
CVE-2019-8909
An issue was discovered in WTCMS 1.0. It allows remote attackers to cause a denial of service resource consumption via crafted dimensions for the verification code image...
CVE-2019-8910
An issue was discovered in WTCMS 1.0. It allows index.php?g=admin&m=setting&a=sitepost CSRF...
Cross site scripting
An issue was discovered in WTCMS 1.0. It has stored XSS via the third text box for the website statistics code...
Design/Logic Flaw
An issue was discovered in WTCMS 1.0. It allows remote attackers to execute arbitrary PHP code by going to the "Setting - Mailbox configuration - Registration email template" screen, and uploading an image file, as demonstrated by a .php filename and the "Content-Type: image/gif" header...
CVE-2019-8909
An issue was discovered in WTCMS 1.0. It allows remote attackers to cause a denial of service resource consumption via crafted dimensions for the verification code image...
CVE-2019-8908
An issue was discovered in WTCMS 1.0. It allows remote attackers to execute arbitrary PHP code by going to the "Setting - Mailbox configuration - Registration email template" screen, and uploading an image file, as demonstrated by a .php filename and the "Content-Type: image/gif" header...