234 matches found
CVE-2020-25453
CVE-2020-25453 affects BlackCat CMS prior to v1.4. It describes a CSRF token bypass vulnerability that enables remote arbitrary code execution. Multiple sources (NVD, Red Hat, OSV, ExploitDB, CVE listings) confirm the issue exists and provide a PoC/exploit context for BlackCat CMS 1.3.6. No offic...
CVE-2020-25453
An issue was discovered in BlackCat CMS before 1.4. There is a CSRF vulnerability bypass csrftoken that allows remote arbitrary code execution...
CVE-2018-16635
Blackcat CMS 1.3.2 allows XSS via the willkommen.php?lang=DE page title at backend/pages/modify.php...
CVE-2018-16635
Blackcat CMS 1.3.2 allows XSS via the willkommen.php?lang=DE page title at backend/pages/modify.php...
Cross site scripting
Blackcat CMS 1.3.2 allows XSS via the willkommen.php?lang=DE page title at backend/pages/modify.php...
CVE-2018-16635
CVE-2018-16635 affects Blackcat CMS 1.3.2 and is an XSS vulnerability exposed via the willkommen.php?lang=DE page title on backend/pages/modify.php. The CVSS metrics indicate a Low (CVSS2: 3.5) to Medium (CVSS3: 5.4) base severity, with network attack vector, low complexity, and user interaction ...
CVE-2018-16635
Blackcat CMS 1.3.2 allows XSS via the willkommen.php?lang=DE page title at backend/pages/modify.php...
Directory traversal
Directory traversal vulnerability in widgets/logs.php in BlackCat CMS before 1.1.2 allows remote attackers to read arbitrary files via a .. dot dot in the dl parameter...
CVE-2015-5079
Directory traversal vulnerability in widgets/logs.php in BlackCat CMS before 1.1.2 allows remote attackers to read arbitrary files via a .. dot dot in the dl parameter...
CVE-2015-5079
Directory traversal vulnerability in widgets/logs.php in BlackCat CMS before 1.1.2 allows remote attackers to read arbitrary files via a .. dot dot in the dl parameter...
CVE-2015-5079
CVE-2015-5079 is a concrete path traversal vulnerability in BlackCat CMS, affecting the widget at widgets/logs.php. The issue arises from insufficient validation of the dl parameter, allowing remote attackers to read arbitrary local files (e.g., config.php) via directory traversal sequences ("../...
blackcat-cideb.com XSS vulnerability
Open Bug Bounty ID: OBB-456883 Description| Value ---|--- Affected Website:| blackcat-cideb.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Chea...
BlackCat CMS File Upload Vulnerability
BlackCat CMS is a content management system CMS based on PHP5 and HTML5 developed by Black Cat team. A security vulnerability exists in BlackCat CMS version 1.2.2, which stems from the program's failure to validate file extensions. The vulnerability can be exploited to upload files with extension...
Unrestricted file upload
In BlackCat CMS 1.2.2, unrestricted file upload is possible in backend\media\ajaxrename.php via the extension parameter, as demonstrated by changing the extension from .jpg to .php...
CVE-2017-14399
In BlackCat CMS 1.2.2, unrestricted file upload is possible in backend\media\ajaxrename.php via the extension parameter, as demonstrated by changing the extension from .jpg to .php...
CVE-2017-14399
In BlackCat CMS 1.2.2, unrestricted file upload is possible in backend\media\ajaxrename.php via the extension parameter, as demonstrated by changing the extension from .jpg to .php...
CVE-2017-14399
The CVE-2017-14399 entry concerns BlackCat CMS 1.2.2, where an unrestricted file upload vulnerability exists in backend/media/ajax_rename.php via the extension parameter. The documented behavior demonstrates changing a .jpg extension to .php, enabling upload of executable PHP files. Connected sou...
CVE-2017-14399
In BlackCat CMS 1.2.2, unrestricted file upload is possible in backend\media\ajaxrename.php via the extension parameter, as demonstrated by changing the extension from .jpg to .php...