45 matches found
Multiple vulnerabilities in baserCMS
Overview baserCMS provided by baserCMS Users Community contains multiple vulnerabilities listed below. Stored cross-site scripting vulnerability due to inappropriate Slug handling on Article Edit CWE-79 - CVE-2024-46996 Stored cross-site scripting vulnerability on Edit Email Form Settings CWE-79 ...
Cross-site Scripting (XSS)
Overview baserproject/basercms is a Content management system based on CakePHP. Affected versions of this package are vulnerable to Cross-site Scripting XSS due to improper handling of slugs on the article editing screen. An attacker can manipulate the output of the page by injecting malicious...
baserCMS 跨站脚本漏洞
baserCMS is an Enterprise Content Management System CMS from the baserCMS team. A cross-site scripting vulnerability exists in baserCMS versions prior to 5.1.2, which stems from a cross-site scripting vulnerability in an HTTP 400 error request...
PT-2024-1852 · Basercms · Basercms
Name of the Vulnerable Software and Affected Versions: baserCMS versions prior to 5.0.9 Description: The issue is related to an OS Command Injection vulnerability in the site search feature of baserCMS. This vulnerability can be exploited by a remote attacker to execute arbitrary commands. The...
PT-2023-28898 · Basercms · Basercms
Name of the Vulnerable Software and Affected Versions: baserCMS versions prior to 4.8.0 Description: The issue is related to a cross-site scripting vulnerability in the file upload feature of baserCMS. This vulnerability may allow malicious code to be executed. The management system is affected...
PT-2022-26203 · Basercms · Basercms
Name of the Vulnerable Software and Affected Versions: baserCMS versions prior to 4.7.2 Description: The issue allows a remote authenticated attacker with administrative privileges to inject an arbitrary script due to a stored cross-site scripting vulnerability in the Permission Settings...
PT-2022-24900 · Basercms · Basercms
Name of the Vulnerable Software and Affected Versions: BaserCMS affected versions not specified Description: The issue is a cross-site scripting vulnerability in the management system of BaserCMS, a content management system with a Japanese language focus. This vulnerability needs to be addressed...
CVE-2021-41243
There is a Potential Zip Slip Vulnerability and OS Command Injection Vulnerability on the management system of baserCMS. Users with permissions to upload files may upload crafted zip files which may execute arbitrary commands on the host operating system. This is a vulnerability that needs to be...
baserCMS 跨站脚本漏洞
BaserCMS is an open source enterprise content management system cms. baserCMS 4.5.0 and earlier versions have a cross-site scripting vulnerability in the file upload feature. No details of the vulnerability are currently available...
baserCMS 跨站脚本漏洞
BaserCMS is an open source enterprise-level content management system cms. A JavaScript Input Improper Neutralization vulnerability exists in the blog post editing feature in versions of BaserCMS prior to 4.4.5. A remote authenticated attacker can exploit this vulnerability to inject arbitrary...
BaserCMS Remote Code Execution Vulnerability
BaserCMS is an open source enterprise-level content management system cms. A remote code execution vulnerability exists in the editor template in versions of baserCMS prior to 4.4.1. The vulnerability can be exploited by a system administrator to achieve remote code execution by uploading an...
BaserCMS Cross-Site Scripting and Remote Code Execution Vulnerabilities
BaserCMS is an open source enterprise-level content management system cms. A cross-site scripting and remote code execution vulnerability exists in the ThemeFilesController.php and UploaderFilesController.php components in baserCMS 4.3.6 and earlier versions. An attacker can exploit this...
BaserCMS Cross-Site Scripting Vulnerability (CNVD-2019-09273)
BaserCMS is an enterprise cms. 4.1.4 A cross-site scripting vulnerability exists in the category name of the "Register New Category" feature in the "Upload" menu of BaserCMS before 4.1.4, which can be exploited via the dataUploaderCategoryname parameter of the admin/uploader/uploadercategories/ed...
BaserCMS Arbitrary PHP Code Execution Vulnerability
BaserCMS is an enterprise cms. An arbitrary PHP code execution vulnerability exists in libBaserModelThemeConfig.php in BaserCMS before 4.1.4, which can be exploited by remote attackers to execute arbitrary PHP code via the admin/themeconfigs/form dataThemeConfiglogo parameter. code...
BaserCMS Code Execution Vulnerability
baserCMS is an enterprise-level content management system CMS. A code execution vulnerability exists in baserCMS versions 3.0.14 and earlier and 4.0.5 and earlier. An attacker can exploit this vulnerability to execute arbitrary PHP code on the server...
BaserCMS Cross-Site Request Forgery Vulnerability (CNVD-2016-08862)
baserCMS is an enterprise-level content management system CMS. A cross-site request forgery vulnerability exists in baserCMS 3.0.10 and prior versions, which stems from the program failing to adequately filter user-submitted input. An attacker could use this vulnerability to delete files or modif...
BaserCMS cross-site scripting vulnerability (CNVD-2016-08856)
baserCMS is an enterprise-level content management system CMS. A cross-site scripting vulnerability exists in baserCMS 3.0.10 and prior versions, which stems from the program failing to adequately filter user-submitted input. The vulnerability allows an attacker to steal cookie-based authenticati...
baserCMS vulnerable to cross-site request forgery
Overview baserCMS provided by baserCMS User Group is an opensource content management system. baserCMS contains a cross-site request forgery vulnerability. Masamu Asato of National Institute of Technology, Okinawa College reported this vulnerability to IPA. JPCERT/CC coordinated with the develope...
Menubook plugin cross-site request forgery vulnerability
Menubook plugin for baserCMS is a menu list plugin for baserCMS. A cross-site request forgery vulnerability exists in Menubook plugin for baserCMS versions prior to 0.9.3, which allows remote attackers to hijack administrars authentication...
