Remote Code Execution (RCE)

winter/storm is vulnerable to Remote Code Execution. An authenticated attacker with permission to create or modify theme templates with the cms editor can disable the cms.enableSafeMode feature, allowing for the modification of the backend php code through the web interface...

PT-2021-11001

Name of the Vulnerable Software and Affected Versions: ForkCMS versions prior to 5.8.3 Description: The issue allows an authenticated remote user to execute malicious code due to PHP object injection in the Ajax endpoint of the backend. Recommendations: For versions prior to 5.8.3, update to...

Flawed Logic Vulnerability in YunMok Backend

YUNMOK adopts PHP + MYSQL as the programming language, through the module and visualization to achieve a technology-free website management operations, users are free to use, and the module can be freely edited, the template can be switched at will. YunMok backend has a logic flaw vulnerability,...

File upload vulnerability in emlog v6.0.0 backend te***.php page

Short for every memory log, emlog is a PHP and MySQL based blog and CMS builder. A file upload vulnerability exists in the emlog v6.0.0 backend te.php page. An attacker can exploit the vulnerability to elevate background privileges...