PT-2018-9248

Name of the Vulnerable Software and Affected Versions: WonderCMS version 2.4.0 Description: The issue allows an attacker to execute arbitrary script on an unsuspecting user's browser through a Stored Cross-Site Scripting vulnerability in the file upload functionality. This is achieved by exploiti...

WonderCMS Malicious File Upload Vulnerability

WonderCMS is an open source, fast, small and simple flat file cms. A malicious file upload vulnerability exists in WonderCMS 2.3.1. The vulnerability arises because the upload function accepts random application extensions. An attacker can exploit this vulnerability to upload malicious files...

WonderCMS Stored Cross-Site Scripting Vulnerability

WonderCMS is an open source, fast, small and simple flat file cms. A stored cross-site scripting vulnerability exists in WonderCMS 2.3.1. The vulnerability arises because the input fields of the application accept arbitrary user input. An attacker can exploit this vulnerability to execute malicio...

WonderCMS HTTP Host Header Injection Vulnerability

WonderCMS is an open source, fast, small and simple flat file cms. WonderCMS 2.3.1 suffers from an HTTP host header injection vulnerability. An attacker can exploit the vulnerability to redirect pages...

Input validation

DISPUTED In WonderCMS 2.3.1, the application's input fields accept arbitrary user input resulting in execution of malicious JavaScript. NOTE: the vendor disputes this issue stating that this is a feature that enables only a logged in administrator to write execute JavaScript anywhere on their...

Design/Logic Flaw

In WonderCMS 2.3.1, the upload functionality accepts random application extensions and leads to malicious File Upload...

Design/Logic Flaw

DISPUTED WonderCMS 2.3.1 is vulnerable to an HTTP Host header injection attack. It uses user-entered values to redirect pages. NOTE: the vendor reports that exploitation is unlikely because the attack can only come from a local machine or from the administrator as a self attack...

CVE-2017-14523

WonderCMS 2.3.1 is vulnerable to an HTTP Host header injection attack. It uses user-entered values to redirect pages. NOTE: the vendor reports that exploitation is unlikely because the attack can only come from a local machine or from the administrator as a self attack...

CVE-2017-14521

In WonderCMS 2.3.1, the upload functionality accepts random application extensions and leads to malicious File Upload...

CVE-2017-14521

In WonderCMS 2.3.1, the upload functionality accepts random application extensions and leads to malicious File Upload...

CVE-2017-14523

WonderCMS 2.3.1 is vulnerable to an HTTP Host header injection attack. It uses user-entered values to redirect pages. NOTE: the vendor reports that exploitation is unlikely because the attack can only come from a local machine or from the administrator as a self attack...

CVE-2017-14522

In WonderCMS 2.3.1, the application's input fields accept arbitrary user input resulting in execution of malicious JavaScript. NOTE: the vendor disputes this issue stating that this is a feature that enables only a logged in administrator to write execute JavaScript anywhere on their website...

CVE-2017-14522

In WonderCMS 2.3.1, the application's input fields accept arbitrary user input resulting in execution of malicious JavaScript. NOTE: the vendor disputes this issue stating that this is a feature that enables only a logged in administrator to write execute JavaScript anywhere on their website...

CVE-2017-14521

WonderCMS 2.3.1 is affected by CVE-2017-14521 due to an upload function that accepts arbitrary file extensions, allowing malicious files to be uploaded. Proof-of-concept materials show a PHP shell upload and access to executed commands via a crafted file, indicating a vulnerability in the file-up...

CVE-2017-14522

Summary: CVE-2017-14522 affects WonderCMS 2.3.1, where input fields can accept arbitrary data and lead to execution of malicious JavaScript. Multiple sources corroborate a stored XSS risk in WonderCMS 2.3.1, with vendor dispute that this is a feature allowing only a logged-in administrator to wri...

CVE-2017-14522

In WonderCMS 2.3.1, the application's input fields accept arbitrary user input resulting in execution of malicious JavaScript. NOTE: the vendor disputes this issue stating that this is a feature that enables only a logged in administrator to write execute JavaScript anywhere on their website...

CVE-2017-14521

In WonderCMS 2.3.1, the upload functionality accepts random application extensions and leads to malicious File Upload...

CVE-2017-14523

WonderCMS 2.3.1 is vulnerable to an HTTP Host header injection attack. It uses user-entered values to redirect pages. NOTE: the vendor reports that exploitation is unlikely because the attack can only come from a local machine or from the administrator as a self attack...

CVE-2017-14523

WonderCMS 2.3.1 is vulnerable to an HTTP Host header injection that allows host header manipulation to redirect pages. The CVE entry notes exploitation is unlikely because the attack would originate from a local machine or an administrator (self-attack). Public exploit references (Exploit-DB/Pack...

CVE-2017-14522

In WonderCMS 2.3.1, the application's input fields accept arbitrary user input resulting in execution of malicious JavaScript. NOTE: the vendor disputes this issue stating that this is a feature that enables only a logged in administrator to write execute JavaScript anywhere on their website...