43 matches found
PT-2023-32557 · Unknown · Getsimple Cms
Name of the Vulnerable Software and Affected Versions: GetSimpleCMS versions 3.3.16 through 3.4.0a Description: A critical issue affects the processing of the file /admin/theme-edit.php, leading to code injection. The attack can be initiated remotely. Recommendations: For versions 3.3.16 through...
WordPress SnazzyAdmin WP Admin Theme Plugin <= 1.0.2 is vulnerable to Cross Site Scripting (XSS)
Software SnazzyAdmin WP Admin Theme Type Plugin Vulnerable versions = 1.0.2 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID e3611a722d35 Credits Rafie Muhammad Patchsta...
PT-2023-22640 · Unknown · Perfreeblog
Name of the Vulnerable Software and Affected Versions: PerfreeBlog version 3.1.2 Description: An arbitrary file upload issue in the /admin/ThemeController.java component allows attackers to execute arbitrary code via a crafted file. Recommendations: For PerfreeBlog version 3.1.2, consider...
CVE-2023-28440 Denial of service via admin theme import route in Discourse
Discourse is an open source platform for community discussion. In affected versions a maliciously crafted request from a Discourse administrator can lead to a long-running request and eventual timeout. This has the greatest potential impact in shared hosting environments where admins are untruste...
CVE-2023-28440 Denial of service via admin theme import route in Discourse
Discourse is an open source platform for community discussion. In affected versions a maliciously crafted request from a Discourse administrator can lead to a long-running request and eventual timeout. This has the greatest potential impact in shared hosting environments where admins are untruste...
CVE-2022-4598
A vulnerability has been found in Shoplazza LifeStyle 1.1 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/api/theme-edit/ of the component Announcement Handler. The manipulation of the argument Text/Mobile Text leads to cross site...
Remote code execution
GetSimple CMS v3.3.16 was discovered to contain a remote code execution RCE vulnerability via the editedfile parameter in admin/theme-edit.php...
CVE-2022-41544
GetSimple CMS v3.3.16 was discovered to contain a remote code execution RCE vulnerability via the editedfile parameter in admin/theme-edit.php...
GetSimple CMS 安全漏洞
GetSimple CMS is a content management system CMS written in PHP. A security vulnerability exists in GetSimple CMS version v3.3.16, which was discovered to contain a remote code execution RCE vulnerability via the editedfile parameter in admin/theme-edit.php...
CVE-2022-41477
A security issue was discovered in WeBid =1.2.2. A Server-Side Request Forgery SSRF vulnerability in the admin/theme.php file allows remote attackers to inject payloads via theme parameters to read files across directories...
PT-2022-25883 · Webid · Webid
Name of the Vulnerable Software and Affected Versions: WeBid versions 1.2.2 and earlier Description: A Server-Side Request Forgery SSRF issue allows remote attackers to inject payloads via theme parameters in the admin/theme.php file to read files across directories. Recommendations: For WeBid...
WeBid 代码问题漏洞
WeBid is an open source auction site building solution. A security vulnerability exists in WeBid 1.2.2 and earlier versions, which stems from a server-side request forgery SSRF vulnerability in the admin/theme.php file that allows remote attackers to inject a payload via theme parameters to read...
WordPress SnazzyAdmin WP Admin Theme plugin <= 1.0.2 - Sensitive Information Disclosure vulnerability
Sensitive Information Disclosure vulnerability discovered in WordPress SnazzyAdmin WP Admin Theme plugin versions = 1.0.2. Solution No patched version available...
PT-2021-8668
Name of the Vulnerable Software and Affected Versions LimeSurvey version 3.6.2+180406 Description The issue is a cross-site scripting XSS vulnerability that allows remote attackers to inject arbitrary web script or HTML. This is achieved via the changes cp parameter to the...
CVE-2021-41866
MyBB before 1.8.28 allows stored XSS because the displayed Template Name value in the Admin CP's theme management is not escaped properly...
ThinkSAAS SQL注入漏洞
ThinkSAAS is a lightweight php open source community system , is a can be used to build discussion groups , bbs forums and circles open open source community system . ThinkSAAS before version 3.38 SQL injection vulnerability exists . The vulnerability is caused by the...
Malicious Package
Overview active-admintheme is a malicious package. Affected versions of this package were found to be a Malicious Package, as it utilised typosquatting to run Malicious 3rd party scripts. It replaced genuine packages using an and replaced it with - and vice versa Remediation Avoid using...
CVE-2019-16333
GetSimple CMS v3.3.15 has Persistent Cross-Site Scripting XSS in admin/theme-edit.php...