CVE-2014-8704

Directory traversal vulnerability in index.php in Wonder CMS 2014 allows remote attackers to include and execute arbitrary local files via a crafted theme...

Cross site scripting

Cross-site scripting XSS vulnerability in Wonder CMS 2014 allows remote attackers to inject arbitrary web script or HTML...

Design/Logic Flaw

Wonder CMS 2014 allows remote attackers to obtain sensitive information by logging into the application with an array for the password, which reveals the installation path in an error message...

CVE-2014-8701

Wonder CMS 2014 allows remote attackers to obtain sensitive information by viewing /files/password, which reveals the unsalted MD5 hashed password...

CVE-2014-8703

Wonder CMS 2014 is affected by a Cross-site scripting (XSS) vulnerability that allows remote attackers to inject arbitrary web script or HTML. The provided documents consistently reference Wonder CMS 2014 in relation to CVE-2014-8703, but do not supply concrete details on vulnerable versions, the...

CVE-2014-8705

The CVE-2014-8705 issue concerns Wonder CMS 2014, where editInplace.php is vulnerable to a PHP Remote File Inclusion. An attacker can trigger arbitrary PHP code execution by supplying a crafted URL in the hook parameter. Connected sources (CNVD-2017-03526) confirm the vulnerability exists in Wond...

CVE-2014-8704

Directory traversal vulnerability in index.php in Wonder CMS 2014 allows remote attackers to include and execute arbitrary local files via a crafted theme...

CVE-2014-8704

CVE-2014-8704 refers to a directory traversal vulnerability in the Wonder CMS 2014 series, specifically in the index.php file. A remote attacker can exploit a specially crafted theme to cause local file inclusion and arbitrary code execution, enabling reading or executing arbitrary local files. T...

CVE-2014-8702

Wonder CMS 2014 has an information disclosure vulnerability where logging in with an array as the password triggers an error message that reveals the installation path. Affected software: Wonder CMS 2014. Root cause: error handling leaks the installation path in the login error message. Impact: p...

CVE-2014-8702

Wonder CMS 2014 allows remote attackers to obtain sensitive information by logging into the application with an array for the password, which reveals the installation path in an error message...

CVE-2014-8705

PHP remote file inclusion vulnerability in editInplace.php in Wonder CMS 2014 allows remote attackers to execute arbitrary PHP code via a URL in the hook parameter...

CVE-2014-8701

CVE-2014-8701 affects Wonder CMS 2014. A remote attacker can view /files/password to obtain sensitive information, exposing unsalted MD5 hashes. Connected records corroborate information disclosure in Wonder CMS 2014, with impact described as partial confidentiality (CVSS2/3 data: base scores 5.0...

Wonder CMS 0.6 Cross Site Scripting

Affected software: wonder cms Type of vulnerability: xss URL: wondercms.com Discovered by: Provensec Website: http://www.provensec.com version 0.6 Proof of concept http://wondercms.com/labs/06beta/?page=%22%3E%3Cimg%20src=d%20onerror=confirm%281%29;%3E...