CVE-2017-16514

Multiple persistent stored Cross-Site-Scripting XSS vulnerabilities in the files /wb/admin/admintools/tool.php Droplet Description and /install/index.php Site Title in WebsiteBaker 2.10.0 allow attackers to insert persistent JavaScript code that gets reflected back to users in multiple areas in t...

CVE-2017-16514

CVE-2017-16514 affects WebsiteBaker 2.10.0, with multiple persistent stored XSS vulnerabilities in the files /wb/admin/admintools/tool.php and /install/index.php. The root cause is persistent JavaScript code being stored and reflected back to users in various areas of the application. Exploitatio...

WebsiteBaker Arbitrary PHP Code Execution Vulnerability

WebsiteBaker is an open source PHP content management system CMS maintained and developed by the WebsiteBaker organization. The system supports WYSIWYG editor, search engine optimization and add-ons. A security vulnerability exists in the install\save.php file in WebsiteBaker version 2.10.0. The...

CVE-2017-9771

install\save.php in WebsiteBaker v2.10.0 allows remote attackers to execute arbitrary PHP code via the databaseusername, databasehost, or databasepassword parameter...

CVE-2017-9771

install\save.php in WebsiteBaker v2.10.0 allows remote attackers to execute arbitrary PHP code via the databaseusername, databasehost, or databasepassword parameter...

Code injection

install\save.php in WebsiteBaker v2.10.0 allows remote attackers to execute arbitrary PHP code via the databaseusername, databasehost, or databasepassword parameter...

CVE-2017-9771

install\save.php in WebsiteBaker v2.10.0 allows remote attackers to execute arbitrary PHP code via the databaseusername, databasehost, or databasepassword parameter...

CVE-2017-9771

Summary: CVE-2017-9771 affects WebsiteBaker v2.10.0, with the vulnerability located in install\save.php. Remote attackers can execute arbitrary PHP code via the parameters database_username, database_host, or database_password. The connected CNVD/NVD entries corroborate this description. No concr...

WebsiteBaker SQL Injection Vulnerability (CNVD-2017-08709)

WebsiteBaker is an open source PHP content management system CMS maintained and developed by the WebsiteBaker organization. The system supports WYSIWYG editor, search engine optimization and add-ons. A SQL injection vulnerability exists in the /account/details.php file in WebsiteBaker version...

WebsiteBaker cross-site scripting vulnerability (CNVD-2017-08708)

WebsiteBaker is an open source PHP content management system CMS maintained and developed by the WebsiteBaker organization. The system supports WYSIWYG editor, search engine optimization and add-ons. A cross-site scripting vulnerability exists in the /account/details.php file in WebsiteBaker...

CVE-2017-9361

WebsiteBaker v2.10.0 has a stored XSS vulnerability in /account/details.php...

Sql injection

WebsiteBaker v2.10.0 has a SQL injection vulnerability in /account/details.php...

Cross site scripting

WebsiteBaker v2.10.0 has a stored XSS vulnerability in /account/details.php...

CVE-2017-9360

WebsiteBaker v2.10.0 has a SQL injection vulnerability in /account/details.php...

CVE-2017-9360

WebsiteBaker v2.10.0 has a SQL injection vulnerability in /account/details.php...

CVE-2017-9360

WebsiteBaker v2.10.0 has a SQL injection vulnerability in /account/details.php...

CVE-2017-9361

WebsiteBaker v2.10.0 has a stored XSS vulnerability in /account/details.php...

CVE-2017-9361

WebsiteBaker v2.10.0 is affected by a stored XSS vulnerability in /account/details.php (CVE-2017-9361). The CNVD entry CNVD-2017-08708 states the vulnerability exists in WebsiteBaker 2.10.0 and a remote attacker can inject arbitrary web script or HTML. The EU/NVD records similarly describe a stor...

CVE-2017-9360

WebsiteBaker v2.10.0 is affected by a SQL injection in /account/details.php. The CNVD entry confirms a remote attacker can exploit this to execute arbitrary SQL commands, implying severe impact on confidentiality, integrity, and possibly availability. The CVE entry itself notes a SQL injection vu...

Multiple SQL Injection Vulnerabilities in WebsiteBaker

websitebaker is an open source content management system CMS. Websitebaker has multiple SQL injection vulnerabilities. Because account/signup.php does not properly handle the values of the variables "username" and "displayname", a remotely authenticated attacker registration is turned on by defau...