Page Builder: PageLayer - Drag and Drop website builder < 1.1.2 - Unprotected AJAX's leading to XSS

Nearly all of the AJAX action endpoints in this plugin failed to include permission checks allowing these actions to be executed by anyone authenticated on the site. The greatest impact was the pagelayersavecontent function that allowed pages to be modified and XSS to occur. PoC $wpuser, 'pwd' =...

Page Builder: PageLayer - Drag and Drop website builder < 1.1.2 - CSRF leading to XSS

A flaw allowed attackers to forge a request on behalf of a site’s administrator to modify the settings of the plugin which could allow for malicious Javascript injection. PoC...

Page Builder: PageLayer - Drag and Drop website builder < 1.1.2 - CSRF leading to XSS

A flaw allowed attackers to forge a request on behalf of a site’s administrator to modify the settings of the plugin which could allow for malicious Javascript injection...

SQL injection vulnerability in the ***se.asp page of the website building system of Zhongshan Cohesion Network Technology Co.

Zhongshan Cohesion Network Technology Co., Ltd. is a company dedicated to Internet branding and Internet marketing. Zhongshan Cohesion Network Technology Co., Ltd. station building system se.asp page SQL injection vulnerability, attackers can use the vulnerability to obtain sensitive information...

Code execution vulnerability exists in ESPCMS (CNVD-2020-32575)

ESPCMS is a free and professional enterprise website building system. A code execution vulnerability exists in ESPCMS, which can be exploited by attackers to execute malicious code and obtain server administrative privileges...

XSS Vulnerability in Tianniu Website Builder System

Tianniu website builder is an extremely fast online website builder platform. An XSS vulnerability exists in the Tianniu website builder system, which can be exploited by an attacker to obtain user cookie information...

File Upload Vulnerability in Hangzhou Vickers Club Network Technology Co.

Hangzhou Vickers Club Network Technology Co., Ltd. is a website builder. A file upload vulnerability exists in the website builder system of Hangzhou Vickers Club Network Technology Co. Ltd, which can be exploited by attackers to upload arbitrary files...

Arbitrary File Download Vulnerability in Website Management System of Hangzhou Viking Club Network Technology Co.

Hangzhou Vickers Club Network Technology Co., Ltd. is a website builder. Hangzhou Vickers Club Network Technology Co., Ltd. website builder management system suffers from an arbitrary file download vulnerability, which can be exploited by an attacker to download arbitrary files...

SQL Injection Vulnerability in Qingdao Huishang Media Co.

Qingdao Hui Shang Media Co., Ltd, is an operator that provides companies with services such as online marketing, brand design, micro-marketing, and software customization and development. There is a SQL injection vulnerability in Qingdao Hui Shang Media Co., Ltd's website building system, which c...

XSS Vulnerability in S-CMS Enterprise Website Builder System

S-CMS is a set of asp/php based enterprise building system CMS. An XSS vulnerability exists in S-CMS enterprise website builder system, which can be exploited by an attacker to obtain an administrator cookie...

XSS Vulnerability in Chinese Online Digital Publishing Group Co.

Bookish China Station Building System is a reading platform that actively serves the development of national reading activities and extends to primary and secondary schools as well as colleges and universities and public libraries. There is an XSS vulnerability in the Chinese Online Digital...

SQL Injection Vulnerability in the Website Building System of Suzhou Topps Network Technology Co.

Suzhou Topps Network Technology Co., Ltd. is engaged in solving the website construction, Baidu promotion, Baidu bidding hosting, Ali network marketing treasure hosting, optimization station rental and sale. Suzhou Topps Network Technology Co., Ltd. station building system there is a SQL injectio...

SQL injection vulnerability in the co***.php page of the website building system of Hubei Guosheng Technology Co.

Ltd. is a full-network value marketing service provider, to provide customers with comprehensive digital innovation services, to help traditional enterprises to realize the "Internet +" transformation and upgrading. There is a SQL injection vulnerability in the co.php page of the website building...

SQL Injection Vulnerability in Hop-Up Website Building System (CNVD-2020-31569)

Founded in 2007, HYN is a comprehensive enterprise specializing in providing customers with a series of enterprise services such as website, mailbox, advertisement, software, finance and tax. There is a SQL injection vulnerability in the website builder system of Hop-Up Network, which can be...

Storage-based cross-site scripting vulnerability exists in the background of enterprise website building system of Zibo Shining Network Technology Co.

Zibo Shining Network Technology Co., Ltd. enterprise station-building system a specialized enterprise station-building solutions for the product. There is a stored cross-site scripting vulnerability in the background of Zibo Shining Network Technology Co. Attackers can use the vulnerability to...

SQL injection vulnerability in pr***.php page of website building system of Kaiping Lianke Network Technology Co.

Kaiping Lianke Network was founded in 2005, is a main website construction, website promotion, speedy software, bathroom ERP management software, micro letter marketing company. There is a SQL injection vulnerability in the pr.php page of the website building system of Kaiping Lianke Network...

SQL Injection Vulnerability in Website Building System of Ningbo Hi-Tech Zone Zhongyu Network Co.

Ningbo Hi-Tech Zone Zhongyu Network Co., Ltd. is a branding and website design service organization. A SQL injection vulnerability exists in the website building system of Ningbo Hi-Tech Zone Zhongyu Network Co. The vulnerability can be exploited by attackers to obtain sensitive information from...

Xi'an Baolian Network Technology Co., Ltd. website building system suffers from SQL injection vulnerabilities (CNVD-2020-32333)

Xi'an BaiLian Network Technology Co., Ltd. is the first technology company specializing in bearing industry management software development and bearing industry portal design. There is a SQL injection vulnerability in the website building system of Xi'an Bailian Network Technology Co. Attackers c...

Command Execution Vulnerability in Baiyi Enterprise Website Building System (CNVD-2020-28073)

Baiyi Enterprise Building System is a simple and pure enterprise building system with powerful content modeling features to meet a variety of enterprise building needs. A command execution vulnerability exists in Baiyi Enterprise Website Builder, which can be exploited by an attacker to execute...

Command Execution Vulnerability in Baiyi Enterprise Website Building System (CNVD-2020-28072)

Baiyi Enterprise Building System is a simple and pure enterprise building system with powerful content modeling features to meet a variety of enterprise building needs. A command execution vulnerability exists in Baiyi Enterprise Website Builder, which can be exploited by an attacker to execute...