PT-2022-23280 · Taocms · Taocms

Name of the Vulnerable Software and Affected Versions: taocms version 3.0.2 Description: An issue was discovered in the website settings that allows arbitrary php code to be injected by modifying config.php. Recommendations: For taocms version 3.0.2, consider restricting access to the config.php...

CVE-2022-36262: Improper Control of Generation of Code

An issue was discovered in taocms 3.0.2. in the website settings that allows arbitrary php code to be injected by modifying config.php...

Cross-site Scripting (XSS) - Stored on Translations

Description Translations are vulnerable to Cross-Site Scripting. Steps to reproduce 1 - Go to Website - Settings 2 - Click on Languages 3 - Fill any field to be translated with an XSS payload : ". 4 - XSS popup will appear. Proof of concept...

Cross-site Scripting (XSS) - Stored in pimcore/pimcore

Vuln : Stored XSS Description The pimcore/pimcore package is an open source platform that provides PIM, MDM, CDP, DAM, DXP/CMS & Digital Commerce services. stored xss vulnerability occurs when you change the value of name at "Setinngs" = "Website Settings" in the pimcore service. Proof of Concept...

Pagelayer < 1.3.5 - Multiple Reflected Cross-Site Scripting (XSS)

Multiple Cross-Site Scripting issues, via the font-size and color parameters of the Website Settings, were fixed in v1.3.5 of the plugin...

CVE-2020-26246

Pimcore is an open source digital experience platform. In Pimcore before version 6.8.5 it is possible to modify & create website settings without having the appropriate permissions...

CVE-2020-26246

Pimcore is an open source digital experience platform. In Pimcore before version 6.8.5 it is possible to modify & create website settings without having the appropriate permissions...

CVE-2020-26246

Pimcore prior to version 6.8.5 is vulnerable to an authorization bypass that allows modifying and creating website settings without proper permissions. The issue stems from insufficient access rights enforcement, enabling an unauthorised user to alter settings, redirects, and asset metadata. Affe...

CVE-2020-26246 Authorization bypass in Pimcore

Pimcore is an open source digital experience platform. In Pimcore before version 6.8.5 it is possible to modify & create website settings without having the appropriate permissions...

PT-2020-16374

Name of the Vulnerable Software and Affected Versions Pimcore versions prior to 6.8.5 Description The issue allows modification and creation of website settings without appropriate permissions. Recommendations For versions prior to 6.8.5, update to version 6.8.5 or later to resolve the issue...

CVE-2020-26246: Improper Authorization

Pimcore is an open source digital experience platform. In Pimcore before version 6.8.5 it is possible to modify & create website settings without having the appropriate permissions...

Pimcore Security Vulnerability

Pimcore is Austria Pimcore company's set of open source for creating and managing Web applications Web content management platform. The platform integrates Web content management, e-commerce frameworks and product information management applications. A security vulnerability exists in Pimcore...

CVE-2020-22273

Neoflex Video Subscription System Version 2.0 is affected by CSRF which allows the Website's Settings to be changed such as Payment Settings...

CVE-2020-22273

Neoflex Video Subscription System Version 2.0 is affected by CSRF which allows the Website's Settings to be changed such as Payment Settings...

CVE-2020-22273

The CVE-2020-22273 entry concerns Neoflex Video Subscription System Version 2.0, where a CSRF flaw enables unauthorized changes to Website Settings (e.g., Payment Settings). The root cause is CSRF allowing state-changing requests without proper user verification. Documents consistently identify t...

CVE-2020-22273: Cross-Site Request Forgery (CSRF)

Neoflex Video Subscription System Version 2.0 is affected by CSRF which allows the Website's Settings to be changed such as Payment Settings...

CVE-2018-17070

An issue was discovered in UNL-CMS 7.59. A CSRF attack can update the website settings via ?q=admin%2Fconfig%2Fsystem%2Fsite-information&render=overlay&render=overlay...

Cross site request forgery (csrf)

An issue was discovered in UNL-CMS 7.59. A CSRF attack can update the website settings via ?q=admin%2Fconfig%2Fsystem%2Fsite-information&render=overlay&render=overlay...

CVE-2018-17070

An issue was discovered in UNL-CMS 7.59. A CSRF attack can update the website settings via ?q=admin%2Fconfig%2Fsystem%2Fsite-information&render=overlay&render=overlay...

CVE-2018-17070

UNL-CMS 7.59 is affected by a CSRF vulnerability (CVE-2018-17070) that allows an attacker to update site settings via the URL path ?q=admin/config/system/site-information&render=overlay&render=overlay. The vulnerability is documented across multiple sources (NVD/CNVD entries) as CSRF that can mod...