53 matches found
CVE-2023-41425
Cross Site Scripting vulnerability in Wonder CMS v.3.2.0 thru v.3.4.2 allows a remote attacker to execute arbitrary code via a crafted script uploaded to the installModule component...
CVE-2023-41425
Cross Site Scripting vulnerability in Wonder CMS v.3.2.0 thru v.3.4.2 allows a remote attacker to execute arbitrary code via a crafted script uploaded to the installModule component...
PT-2023-6828
Name of the Vulnerable Software and Affected Versions Wonder CMS versions 3.2.0 through 3.4.2 Description The issue is related to a Cross Site Scripting vulnerability that allows a remote attacker to execute arbitrary code via a crafted script uploaded to the installModule component. This...
Wonder CMS 2.3.1 - Unrestricted File Upload
Wonder CMS 2.3.1 - Unrestricted File Upload Affected Code: public static function uploadFile + - if ! wCMS::$loggedIn && ! isset$FILES'uploadFile' && ! isset$REQUEST'token' return; + private static function uploadFileAction - if isset$REQUEST'token' && $REQUEST'token' == wCMS::generateToken &&...
Wonder CMS 2.3.1 - Unrestricted File Upload Vulnerability
Exploit for php platform in category web applications Affected Code: public static function uploadFile + - if ! wCMS::$loggedIn && ! isset$FILES'uploadFile' && ! isset$REQUEST'token' return; + private static function uploadFileAction - if isset$REQUEST'token' && $REQUEST'token' ==...
Wonder CMS 2.3.1 File Upload
Affected Code: public static function uploadFile + - if ! wCMS::$loggedIn && ! isset$FILES'uploadFile' && ! isset$REQUEST'token' return; + private static function uploadFileAction - if isset$REQUEST'token' && $REQUEST'token' == wCMS::generateToken && isset$FILES'uploadFile' Proof of Concept Steps...
Wonder CMS 2.3.1 Host Header Injection
Exploit Title: Wonder CMS 2.3.1 Host Header Injection Date: 30-01-2018 Exploit Author: Samrat Das Contact: http://twitter.com/SamratDas93 Website: https://securitywarrior9.blogspot.in/ Vendor Homepage: https://www.wondercms.com/ Version: 2.3.1 CVE : CVE-2017-14523 Category: Webapp CMS 1...
Wonder CMS 2.3.1 - Host Header Injection
Wonder CMS 2.3.1 - Host Header Injection Exploit Title: Wonder CMS 2.3.1 Host Header Injection Date: 30-01-2018 Exploit Author: Samrat Das Contact: http://twitter.com/SamratDas93 Website: https://securitywarrior9.blogspot.in/ Vendor Homepage: https://www.wondercms.com/ Version: 2.3.1 CVE :...
Wonder CMS 2.3.1 - 'Host' Header Injection
Exploit Title: Wonder CMS 2.3.1 Host Header Injection Date: 30-01-2018 Exploit Author: Samrat Das Contact: http://twitter.com/SamratDas93 Website: https://securitywarrior9.blogspot.in/ Vendor Homepage: https://www.wondercms.com/ Version: 2.3.1 CVE : CVE-2017-14523 Category: Webapp CMS 1...
Wonder CMS Information Disclosure Vulnerability
Wonder CMS is an open source content management system CMS. An information disclosure vulnerability exists in Wonder CMS version 2014. A remote attacker can exploit this vulnerability to obtain sensitive information by viewing /files/password...
Wonder CMS Information Disclosure Vulnerability (CNVD-2017-03503)
Wonder CMS is an open source content management system CMS. A security vulnerability exists in Wonder CMS version 2014. A remote attacker could exploit the vulnerability by logging into the application using an array as a password to obtain the installation path in an error message...
Wonder CMS Path Traversal Vulnerability
Wonder CMS is an open source content management system CMS. A directory traversal vulnerability exists in the index.php file in Wonder CMS version 2014. A remote attacker can exploit this vulnerability to read arbitrary files with the help of a specially crafted theme...
Wonder CMS PHP Remote File Inclusion
Wonder CMS is an open source content management system CMS. A PHP remote file inclusion vulnerability exists in the editInplace.php file in Wonder CMS version 2014. A remote attacker can execute arbitrary PHP code with the help of the hook parameter in the URL...
Wonder CMS Cross-Site Scripting Vulnerability
Wonder CMS is an open source content management system CMS. A cross-site scripting vulnerability exists in Wonder CMS version 2014. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML...
Remote file inclusion
PHP remote file inclusion vulnerability in editInplace.php in Wonder CMS 2014 allows remote attackers to execute arbitrary PHP code via a URL in the hook parameter...
Directory traversal
Directory traversal vulnerability in index.php in Wonder CMS 2014 allows remote attackers to include and execute arbitrary local files via a crafted theme...
Default credentials
Wonder CMS 2014 allows remote attackers to obtain sensitive information by viewing /files/password, which reveals the unsalted MD5 hashed password...
CVE-2014-8701
Wonder CMS 2014 allows remote attackers to obtain sensitive information by viewing /files/password, which reveals the unsalted MD5 hashed password...
CVE-2014-8702
Wonder CMS 2014 allows remote attackers to obtain sensitive information by logging into the application with an array for the password, which reveals the installation path in an error message...