CVE-2019-8911

An issue was discovered in WTCMS 1.0. It has stored XSS via the third text box for the website statistics code...

Cross site request forgery (csrf)

An issue was discovered in WTCMS 1.0. It allows index.php?g=admin&m=setting&a=sitepost CSRF...

CVE-2019-8910

CVE-2019-8910 affects WTCMS 1.0 and describes a cross-site request forgery in index.php?g=admin&m=setting&a=site_post. Public sources (CNVD/Red Hat/NVD) note it can be exploited by remote attackers to alter website information. The NVD lists CVSS v3 base score 8.8 (HIGH) with network access, user...

CVE-2019-8911

CVE-2019-8911 affects WTCMS 1.0 and is a stored XSS vulnerability exploitable via the third text box used for the website statistics code. Multiple connected documents corroborate the issue as a cross-site scripting vulnerability in the CMS, with the described impact limited to injected script/HT...

CVE-2019-8910

An issue was discovered in WTCMS 1.0. It allows index.php?g=admin&m=setting&a=sitepost CSRF...

CVE-2019-8908

CVE-2019-8908 affects WTCMS 1.0. An arbitrary PHP code execution is possible by visiting Settings → Mailbox configuration → Registration email template and uploading an image file, demonstrated with a .php filename and the Content-Type: image/gif header. The issue is triggered through the image u...

CVE-2019-8908

An issue was discovered in WTCMS 1.0. It allows remote attackers to execute arbitrary PHP code by going to the "Setting - Mailbox configuration - Registration email template" screen, and uploading an image file, as demonstrated by a .php filename and the "Content-Type: image/gif" header...

CVE-2019-8909

WTCMS 1.0 contains a denial-of-service vulnerability whereby remote attackers can induce resource consumption by sending specially crafted dimensions for the verification-code image. Affected product: WTCMS 1.0. Root cause: the verification code image handling accepts crafted dimensions, leading ...

CVE-2019-8909

An issue was discovered in WTCMS 1.0. It allows remote attackers to cause a denial of service resource consumption via crafted dimensions for the verification code image...

CVE-2019-8911

An issue was discovered in WTCMS 1.0. It has stored XSS via the third text box for the website statistics code...

PT-2019-19254

Name of the Vulnerable Software and Affected Versions WTCMS version 1.0 Description An issue was discovered that allows a CSRF attack through the "index.php?g=admin&m=setting&a=site post" endpoint, specifically targeting the site post action within the setting module of the admin interface...

CVE-2019-8911: Improper Neutralization of Input During Web Page Generation

An issue was discovered in WTCMS 1.0. It has stored XSS via the third text box for the website statistics code...

CVE-2019-8910: Cross-Site Request Forgery (CSRF)

An issue was discovered in WTCMS 1.0. It allows index.php?g=admin&m=setting&a=sitepost CSRF...

PT-2019-19255

Name of the Vulnerable Software and Affected Versions WTCMS version 1.0 Description An issue was discovered that allows stored XSS via the third text box, which is used for the website statistics code. Recommendations For WTCMS version 1.0, consider disabling the third text box for website...

CVE-2019-8909: Uncontrolled Resource Consumption

An issue was discovered in WTCMS 1.0. It allows remote attackers to cause a denial of service resource consumption via crafted dimensions for the verification code image...

PT-2019-19253

Name of the Vulnerable Software and Affected Versions WTCMS version 1.0 Description An issue in WTCMS allows remote attackers to cause a denial of service through resource consumption by crafting dimensions for the verification code image. Recommendations For WTCMS version 1.0, at the moment, the...

PT-2019-19252

Name of the Vulnerable Software and Affected Versions WTCMS version 1.0 Description An issue in WTCMS allows remote attackers to execute arbitrary PHP code. This can be achieved by accessing the "Setting - Mailbox configuration - Registration email template" screen and uploading an image file wit...

CVE-2019-8908: Use of Incorrectly-Resolved Name or Reference

An issue was discovered in WTCMS 1.0. It allows remote attackers to execute arbitrary PHP code by going to the "Setting - Mailbox configuration - Registration email template" screen, and uploading an image file, as demonstrated by a .php filename and the "Content-Type: image/gif" header...

Code execution vulnerability in WTCMS backend

WTCMS is a content management system CMS based on Thinkphp. A code execution vulnerability exists in the WTCMS backend, which can be exploited by an attacker to gain control of the web server...

WTCMS Cross-Site Request Forgery Vulnerability

WTCMS is a content management system CMS based on Thinkphp. A cross-site request forgery vulnerability exists in WTCMS version 1.0. A remote attacker can exploit this vulnerability to add an administrator account with the help of the index.php?admin&m=user&a=addpost URI...