PT-2019-9642

Name of the Vulnerable Software and Affected Versions WolfCMS version 0.8.3.1 Description The issue allows for XSS via an SVG file. This can be achieved by accessing the /admin/plugin/file manager/browse/ API endpoint. Recommendations For WolfCMS version 0.8.3.1, update to a newer version that...

PT-2019-9643

Name of the Vulnerable Software and Affected Versions WolfCMS version 0.8.3.1 Description The issue allows for XSS via an SVG file. This can be exploited by accessing the /admin/plugin/file manager/browse/ API endpoint. Recommendations For WolfCMS version 0.8.3.1, consider restricting access to t...

PT-2019-10221

Name of the Vulnerable Software and Affected Versions: Frog CMS version 0.9.5 Description: The issue allows for XSS by creating a new file containing a crafted attribute of an IMG element, specifically targeting the "admin/?/plugin/file manager" endpoint. Recommendations: For Frog CMS version...

PT-2018-13527

Name of the Vulnerable Software and Affected Versions Frog CMS version 0.9.5 Description The issue allows creation of files via the "/admin/?/plugin/file manager/save" API endpoint. Recommendations For Frog CMS version 0.9.5, consider disabling the file manager plugin until a patch is available...

PT-2018-10308

Name of the Vulnerable Software and Affected Versions Frog CMS version 0.9.5 Description An issue was discovered in Frog CMS, where there is a file upload vulnerability via the "admin/?/plugin/file manager/upload" URI. Recommendations For Frog CMS version 0.9.5, consider restricting access to the...

PT-2017-7036

Name of the Vulnerable Software and Affected Versions Wolf CMS versions prior to 0.8.3.1 Description The issue allows for unrestricted file rename and PHP code execution. This is because the file manager, located at the admin/plugin/file manager/browse/ endpoint, does not prevent a file extension...

PT-2012-3635

Name of the Vulnerable Software and Affected Versions Wolf CMS versions 0.75 and earlier Description The issue allows remote attackers to hijack the authentication of administrators for various requests. This includes deleting users via the user id number to "admin/user/delete", deleting pages vi...