Xxe

TYPO3 is an open source PHP based web content management system. In TYPO3 from version 10.4.0, and before version 10.4.10, RSS widgets are susceptible to XML external entity processing. This vulnerability is reasonable, but is theoretical - it was not possible to actually reproduce the...

CVE-2020-26229

TYPO3 RSS widgets (Dashboard) are affected by an XML External Entity (XXE) issue in TYPO3 10.4.0–10.4.9, enabling XXE processing due to vulnerable XML handling. The issue is considered low risk/limited impact and notable for requiring a backend user account; no public exploitation details are pro...

CVE-2020-26227

TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 9.5.23 and 10.4.10 the system extension Fluid typo3/cms-fluid of the TYPO3 core is vulnerable to cross-site scripting passing user-controlled data as argument to Fluid view helpers. Update to TYPO3 versions...

CVE-2020-26228

TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 9.5.23 and 10.4.10 user session identifiers were stored in cleartext - without processing with additional cryptographic hashing algorithms. This vulnerability cannot be exploited directly and occurs in...

CVE-2020-26228

TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 9.5.23 and 10.4.10 user session identifiers were stored in cleartext - without processing with additional cryptographic hashing algorithms. This vulnerability cannot be exploited directly and occurs in...

Sql injection

TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 9.5.23 and 10.4.10 user session identifiers were stored in cleartext - without processing with additional cryptographic hashing algorithms. This vulnerability cannot be exploited directly and occurs in...

Cross site scripting

TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 9.5.23 and 10.4.10 the system extension Fluid typo3/cms-fluid of the TYPO3 core is vulnerable to cross-site scripting passing user-controlled data as argument to Fluid view helpers. Update to TYPO3 versions...

CVE-2020-26228

TYPO3 prior to versions 9.5.23 and 10.4.10 stores user session identifiers in cleartext (no extra cryptographic hashing). The issue cannot be exploited directly and requires a chained attack (e.g., SQL injection in another component). Affected software is TYPO3 CMS (PHP-based). The remediation is...

SAP Commerce Cloud Cross-Site Scripting Vulnerability

SAP Commerce Cloud is a cloud-based e-commerce platform. A cross-site script execution vulnerability exists in SAP Commerce Cloud versions 1808, 1811, 1905, and 2005. The vulnerability stems from the program not properly encoding user input. An attacker could exploit this recording vulnerability ...

Arbitrary File Deletion Vulnerability in XiaoCMS

XiaoCms is a web content management system, provides enterprise building system, station system. XiaoCMS suffers from an arbitrary file deletion vulnerability. An attacker can exploit the vulnerability to delete any directory on the server...

Command Execution Vulnerability in UCMS

UCMS is a simple web content management system. A command execution vulnerability exists in UCMS, which can be exploited by an attacker to gain administrative privileges on the server...

Code Execution Vulnerability in WMCMS of Chongqing Yu Yue Optoelectronics Technology Co.

WMCMS is a set of PHP + MYSQL based on the core development, free + open source professional Chinese labeling station-building system. WMCMS has a code execution vulnerability that can be exploited by an attacker to gain administrative privileges on the web server...

ZZCMS Buildable Product Merchandising Website Has Reinstallation Vulnerability

ZZCMS Buildable Product Merchandising Website is a PHP and MYSQL based CMS to quickly build product merchandising websites. The ZZCMS Buildable Product Merchandising Website has a reinstallation vulnerability that can be exploited by an attacker to overwrite the previous install.lock file,...

Composr CMS 10.0.30 - Persistent Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Title: Composr CMS 10.0.30 - Persistent Cross-Site Scripting Author: Manuel Garcia Cardenas Vendor: https://compo.sr/ CVE: N/A ============================================= MGC ALERT 2020-001 - Original release date: February 06, 2020 - Last...

Extreme CMS suffers from a file upload vulnerability (CNVD-2020-32535)

Extreme CMS is an open source and free web content management system. Extreme CMS has a file upload vulnerability that can be exploited by an attacker to upload malicious files and gain administrative privileges on the server...

WCMS suffers from SQL injection vulnerability (CNVD-2020-25555)

WCMS is an open source lightweight CMS system. WCMS suffers from an SQL injection vulnerability, which can be exploited by attackers to obtain sensitive database information...

XSS Vulnerability in Extreme CMS Beta 1.6.7

Extreme CMS Beta is a php+mysql an open source CMS system. Extreme CMS Beta 1.6.7 suffers from an XSS vulnerability, which can be exploited by attackers to execute malicious code and obtain administrator cookies...

Extreme cms has file upload vulnerability

Extreme CMS is an open source PHPCMS web content management system. Extreme CMS has a file upload vulnerability that can be exploited by attackers to gain server privileges...

Arbitrary File Deletion Vulnerability in ClanSphere

ClanSphere is a web content management system primarily used for building tribal and eSports websites. ClanSphere suffers from an arbitrary file deletion vulnerability that can be exploited by an attacker to delete arbitrary files...

Command Execution Vulnerability in CmsEasy

CmsEasy is a web content management system based on PHP+Mysql architecture and a PHP development platform. A command execution vulnerability exists in CmsEasy, which allows attackers to exploit the vulnerability to execute commands to gain server privileges...