CVE-2026-29598

CVE-2026-29598: cm3 Acora CMS 버전 10.7.1의 저장형 교차 사이트 스크립팅XSS 취약점 DDSN Interactive cm3 Acora CMS 버전 10.7.1에는 사용자 관리 기능에 저장형 교차 사이트 스크립팅XSS 취약점이 존재합니다. 사용자 세부 정보를 추가하거나 편집할 수 있는 관리자는 "/submitadduser.asp" 및 "/submitedituser.asp" 엔드포인트를 통해 "이름" 및 "성"과 같은 필드에 악성 스크립트를 실수로 주입할 수 있습니다. 이러한 스크립트는 애플리케이션의...

CVE-2025-63314

CVE-2025-63314 - Acora CMS의 비밀번호 재설정 토큰 부적절 처리 Crowe India의 Joby Y Daniel이 발견함 📌 개요 DDSN Interactive cm3 Acora CMS 버전 10.7.1 은 비밀번호 재설정 기능에 보안 취약점을 포함하고 있습니다. 애플리케이션은 정적이고 지속적인 비밀번호 재설정 토큰을 사용하며, 이 토큰은 사용 후 무효화되지 않고 시간이 지나도 만료되지 않습니다. 이 결함으로 인해 유효한 재설정 토큰을 획득한 공격자가 해당 토큰을 무기한 재사용할 수 있으며, 이는 권한 있는...

Session fixation

DDSN Interactive cm3 Acora CMS 6.0.6/1a, 6.0.2/1a, 5.5.7/12b, 5.5.0/1b-p1, and possibly other versions, does not set the secure flag for an unspecified cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http...

CVE-2013-4728

CVE-2013-4728 affects DDSN Interactive cm3 Acora CMS versions such as 6.0.6/1a, 6.0.2/1a, 5.5.7/12b, 5.5.0/1b-p1 (and possibly others). The vulnerability allows remote attackers to obtain sensitive information via a crafted .. (dot dot) in the l parameter, which reveals the installation path in a...

CVE-2013-4725

DDSN Interactive cm3 Acora CMS 6.0.6/1a, 6.0.2/1a, 5.5.7/12b, 5.5.0/1b-p1, and possibly other versions, does not set the secure flag for an unspecified cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http...

CVE-2013-4724

CVE-2013-4724 affects DDSN Interactive cm3 Acora CMS versions including 6.0.6/1a, 6.0.2/1a, 5.5.7/12b, 5.5.0/1b-p1 (and possibly others). The issue is failure to set the HTTPOnly flag on a Set-Cookie header for an unspecified cookie, potentially allowing remote attackers to access sensitive cooki...

CVE-2013-4725

CVE-2013-4725 affects DDSN Interactive cm3 Acora CMS versions 6.0.6/1a, 6.0.2/1a, 5.5.7/12b, 5.5.0/1b-p1 (and possibly others). Description: the CMS does not set the Secure flag on an unspecified cookie in HTTPS sessions, allowing an attacker to capture the cookie by intercepting its transmission...

CVE-2013-4726

Cross-site request forgery CSRF vulnerability in DDSN Interactive cm3 Acora CMS 6.0.6/1a, 6.0.2/1a, 5.5.7/12b, 5.5.0/1b-p1, and possibly other versions, allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...

CVE-2013-4723

Open redirect vulnerability in DDSN Interactive cm3 Acora CMS 6.0.6/1a, 6.0.2/1a, 5.5.7/12b, 5.5.0/1b-p1, and possibly other versions allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the l parameter to track.aspx...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Admin/login/default.asp in DDSN Interactive cm3 Acora CMS 6.0.6/1a, 6.0.2/1a, 5.5.7/12b, 5.5.0/1b-p1, and possibly other versions allow remote attackers to inject arbitrary web script or HTML via the 1 username, 2 url, 3 qstr parameter...

CVE-2013-4726

CVE-2013-4726 concerns Acora CMS (CM3 AcoraCMS) in DDSN Interactive, affected versions include 6.0.6/1a, 6.0.2/1a, 5.5.7/12b, 5.5.0/1b-p1 (and possibly others). The description states a Cross-site request forgery (CSRF) vulnerability that allows remote attackers to hijack the authentication of un...

CVE-2013-4722

Multiple cross-site scripting XSS vulnerabilities in Admin/login/default.asp in DDSN Interactive cm3 Acora CMS 6.0.6/1a, 6.0.2/1a, 5.5.7/12b, 5.5.0/1b-p1, and possibly other versions allow remote attackers to inject arbitrary web script or HTML via the 1 username, 2 url, 3 qstr parameter...

CVE-2013-4722

CVE-2013-4722 affects Acora CMS (DDSN cm3 Acora CMS) prior to or within versions 6.0.6/1a, 6.0.2/1a, 5.5.7/12b, 5.5.0/1b-p1. The vulnerability is a reflected cross-site scripting (XSS) in Admin/login/default.asp caused by insufficient input validation and lack of output escaping for parameters us...

CVE-2013-4726

Cross-site request forgery CSRF vulnerability in DDSN Interactive cm3 Acora CMS 6.0.6/1a, 6.0.2/1a, 5.5.7/12b, 5.5.0/1b-p1, and possibly other versions, allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...