Zenario CMS 9.0.54156 - Remote Code Execution (Authenticated) Exploit

Exploit Title: Zenario CMS 9.0.54156 - Remote Code Execution RCE Authenticated Exploit Author: minhnq22 Vendor Homepage: https://zenar.io/ Software Link: https://zenar.io/download-page Version: 9.0.54156 Tested on: Ubuntu 21.04 CVE : CVE-2021–42171 Python3 import os import sys import json import...

Zenario CMS 9.0.54156 Remote Code Execution

Exploit Title: Zenario CMS 9.0.54156 - Remote Code Execution RCE Authenticated Date: 04/02/2022 Exploit Author: minhnq22 Vendor Homepage: https://zenar.io/ Software Link: https://zenar.io/download-page Version: 9.0.54156 Tested on: Ubuntu 21.04 CVE : CVE-2021–42171 Python3 import os import sys...

Zenario CMS 9.0.54156 - Remote Code Execution (RCE) (Authenticated)

Exploit Title: Zenario CMS 9.0.54156 - Remote Code Execution RCE Authenticated Date: 04/02/2022 Exploit Author: minhnq22 Vendor Homepage: https://zenar.io/ Software Link: https://zenar.io/download-page Version: 9.0.54156 Tested on: Ubuntu 21.04 CVE : CVE-2021–42171 Python3 import os import sys...

SQL Injection

tribalsystems/zenario is vulnerable to SQL injection. The vulnerability exists due to a lack of sanitization of the ID input field of ajax.php in the Pugin library - delete module...

GHSA-W4F3-7F7C-X652 SQL Injection in tribalsystems/zenario

SQL Injection in Tribalsystems Zenario CMS 8.8.52729 and prior allows remote attackers to access the database or delete the plugin. This is accomplished via the ID input field of ajax.php in the Pugin library - delete module...

SQL Injection in tribalsystems/zenario

SQL Injection in Tribalsystems Zenario CMS 8.8.52729 and prior allows remote attackers to access the database or delete the plugin. This is accomplished via the ID input field of ajax.php in the Pugin library - delete module...

Zenario CMS File Upload Vulnerability (CNVD-2022-21547)

Zenario CMS is an open source application from Zenario. A file upload vulnerability exists in Zenario CMS version 9.0.54156, which stems from the application's lack of validation of uploaded files. An attacker could exploit the vulnerability to upload malicious files to remotely execute arbitrary...

Cross-site Scripting in Zenario CMS

Zenario CMS 9.0.54156 is vulnerable to Cross Site Scripting XSS via upload file to .SVG. An attacker can send malicious files to victims and steals victim's cookie leads to account takeover. The person viewing the image of a contact can be victim of XSS...

GHSA-X8WJ-CQMP-3WMM Cross-site Scripting in Zenario CMS

Zenario CMS 9.0.54156 is vulnerable to Cross Site Scripting XSS via upload file to .SVG. An attacker can send malicious files to victims and steals victim's cookie leads to account takeover. The person viewing the image of a contact can be victim of XSS...

GHSA-RGG3-3WH7-W935 Unrestricted Upload of File with Dangerous Type in Zenario CMS

Zenario CMS 9.0.54156 is vulnerable to File Upload. The web server can be compromised by uploading and executing a web-shell which can run commands, browse system files, browse local resources, attack other servers, and exploit the local vulnerabilities, and so forth...

Unrestricted Upload of File with Dangerous Type in Zenario CMS

Zenario CMS 9.0.54156 is vulnerable to File Upload. The web server can be compromised by uploading and executing a web-shell which can run commands, browse system files, browse local resources, attack other servers, and exploit the local vulnerabilities, and so forth...

CVE-2021-42171

Zenario CMS 9.0.54156 is vulnerable to File Upload. The web server can be compromised by uploading and executing a web-shell which can run commands, browse system files, browse local resources, attack other servers, and exploit the local vulnerabilities, and so forth...

CVE-2021-42171

Zenario CMS 9.0.54156 is vulnerable to File Upload. The web server can be compromised by uploading and executing a web-shell which can run commands, browse system files, browse local resources, attack other servers, and exploit the local vulnerabilities, and so forth...

CVE-2021-41952

Zenario CMS 9.0.54156 is vulnerable to Cross Site Scripting XSS via upload file to .SVG. An attacker can send malicious files to victims and steals victim's cookie leads to account takeover. The person viewing the image of a contact can be victim of XSS...

CVE-2021-41952

Zenario CMS 9.0.54156 is vulnerable to Cross Site Scripting XSS via upload file to .SVG. An attacker can send malicious files to victims and steals victim's cookie leads to account takeover. The person viewing the image of a contact can be victim of XSS...

CVE-2021-42171

Zenario CMS 9.0.54156 is vulnerable to File Upload. The web server can be compromised by uploading and executing a web-shell which can run commands, browse system files, browse local resources, attack other servers, and exploit the local vulnerabilities, and so forth...

CVE-2021-41952

Zenario CMS 9.0.54156 is vulnerable to Cross Site Scripting XSS via upload file to .SVG. An attacker can send malicious files to victims and steals victim's cookie leads to account takeover. The person viewing the image of a contact can be victim of XSS...

Unrestricted file upload

Zenario CMS 9.0.54156 is vulnerable to File Upload. The web server can be compromised by uploading and executing a web-shell which can run commands, browse system files, browse local resources, attack other servers, and exploit the local vulnerabilities, and so forth...

Cross site scripting

Zenario CMS 9.0.54156 is vulnerable to Cross Site Scripting XSS via upload file to .SVG. An attacker can send malicious files to victims and steals victim's cookie leads to account takeover. The person viewing the image of a contact can be victim of XSS...

CVE-2021-41952

CVE-2021-41952 relates to Zenario CMS 9.0.54156, where an XSS vulnerability exists through uploading SVG files. The technical detail in the connected advisories confirms that an attacker can craft a malicious SVG upload to trigger a cross-site scripting condition, enabling theft of victim cookies...