417 matches found
bycms 跨站请求伪造漏洞
bycms is a simple, easy-to-use content management system. A cross-site request forgery vulnerability exists in bycms v1.3, which can be triggered by an attacker via admin.php/systems/index/moduleid/70/groupid/1.html...
CVE-2020-22206
SQL Injection in ECShop 3.0 via the aid parameter to admin/affiliateck.php...
CVE-2020-36005
AppCMS 2.0.101 in /admin/app.php has an arbitrary file deletion vulnerability which allows attackers to delete arbitrary files on the site...
CVE-2021-29439
The Grav admin plugin prior to version 1.10.11 does not correctly verify caller's privileges. As a consequence, users with the permission admin.login can install third-party plugins and their dependencies. By installing the right plugin, an attacker can obtain an arbitrary code execution primitiv...
PT-2021-18215 · Grav · Grav Admin Plugin
Name of the Vulnerable Software and Affected Versions: Grav admin plugin versions prior to 1.10.11 Description: The issue arises from incorrect verification of caller's privileges, allowing users with the admin.login permission to install third-party plugins and their dependencies. This can lead ...
Smartstore SmartStoreNET 跨站请求伪造漏洞
Smartstore SmartStoreNET is an open source e-commerce Web platform of Germany Smartstore company . The platform includes CRM, CMS, sales, marketing, payment, order processing and other functions. A cross-site request forgery vulnerability exists in Smartstore SmartStoreNET versions prior to 4.1.0...
CVE-2019-16997
In Metinfo 7.0.0beta, a SQL Injection was discovered in app/system/language/admin/languagegeneral.class.php via the admin/?n=language&c=languagegeneral&a=doExportPack appno parameter...
CVE-2019-9912
The wp-google-maps plugin before 7.10.43 for WordPress has XSS via the wp-admin/admin.php PATHINFO...
LFCMS Directory Traversal Vulnerability
Lei Feng TV CMS aka LFCMS is a video-on-demand system developed using PHP and MySQL. LFCMS version 3.8.6 of http://www.a.com:84/admin.php?s=/Template/index.html页面存在目录遍历漏洞. An attacker can exploit this vulnerability with the help of the '...' sequence in the Template/edit/path URIs. ' sequence in...
DamiCMS Arbitrary File Read Vulnerability
DamiCMS is a content management system CMS for building websites quickly. A security vulnerability exists in DamiCMS version 6.0.1. A remote attacker can exploit the vulnerability by sending a specially crafted request admin.php?s=Tpl/Add/id to read arbitrary files...
tp5cms cross-site scripting vulnerability (CNVD-2018-26479)
tp5cms is a content management system CMS framework written in the PHP language and based on technologies such as ThinkPHP, swiper and bootstrap. A cross-site scripting vulnerability exists in the admin.php/system/set.html page in tp5cms 2017-05-25 and earlier versions. A remote attacker can...
CVE-2018-18773
CentOS-WebPanel.com aka CWP CentOS Web Panel through 0.9.8.740 allows CSRF via admin/index.php?module=rootpwd, as demonstrated by changing the root password...
XiaoCms Information Disclosure Vulnerability
XiaoCms is a lightweight content management system CMS based on PHP and MySQL and capable of running on Linux, Windows and other platforms. A security vulnerability exists in /admin/index.php?c=database in XiaoCms version 20141229. The vulnerability can be exploited to obtain the full path with t...
CVE-2018-18741
An XSS issue was discovered in SEMCMS 3.4 via admin/SEMCMSDownload.php?lgid=1 during editing...
YUNUCMS cross-site scripting vulnerability (CNVD-2018-23278)
YUNUCMS is a three-network, self-substation system of open source content management system. YUNUCMS 1.1.5 in admin/sitelink/editsitelink?id=16 cross-site scripting vulnerability, attackers can exploit the vulnerability to carry out cross-site attacks...
Catfish CMS Cross-Site Request Forgery Vulnerability
Catfish CMS is an open source content management system CMS written in PHP. A cross-site request forgery vulnerability exists in the admin/Index/addmanageuser.html page in Catfish CMS version 4.8.30, which can be exploited by remote attackers to add users...
CVE-2018-18420
Cross-Site Request Forgery CSRF vulnerability was discovered in the 8.3 version of Zenario Content Management System via the admin/organizer.ajax.php?path=zenariocontent%2Fpanels%2Fcontent URI...
Hot Drama CMS v2.1 has a flawed logic vulnerability
Hot Drama CMS is a movie and TV station building system developed by PHP+MySQL. There is a logic flaw vulnerability in /admin/cm.php in Hot Drama CMS v2.1, which can be exploited by an attacker to log in to the administration background by modifying the cookie value...