91 matches found
CVE-2021-21264 Bypass of fix for CVE-2020-26231, Twig sandbox escape
October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. A bypass of CVE-2020-26231 fixed in 1.0.470/471 and 1.1.1 was discovered that has the same impact as CVE-2020-26231 & CVE-2020-15247. An authenticated backend user with the cms.managepages,...
CVE-2019-10708
S-CMS PHP v1.0 has SQL injection via the 4/js/scms.php?action=unlike id parameter...
Sql injection
S-CMS PHP v1.0 has SQL injection via the 4/js/scms.php?action=unlike id parameter...
CVE-2019-10708
S-CMS PHP v1.0 has SQL injection via the 4/js/scms.php?action=unlike id parameter...
CVE-2019-10708
S-CMS PHP v1.0 has SQL injection via the 4/js/scms.php?action=unlike id parameter...
CVE-2019-10708
CVE-2019-10708 affects S-CMS PHP v1.0. The vulnerability is a SQL injection in the parameter 4/js/scms.php?action=unlike, due to insufficient input validation, allowing an attacker to inject SQL statements. The NVD/NVD-derived metrics indicate high/critical risk (CVSS v2: 7.5; CVSS v3: 9.8). Publ...
PT-2019-12000
Name of the Vulnerable Software and Affected Versions S-CMS PHP version 1.0 Description The issue is related to SQL injection, which can be exploited via the id parameter in the /js/scms.php?action=unlike API endpoint. Recommendations For S-CMS PHP version 1.0, as a temporary workaround, consider...
CVE-2019-10708: Improper Neutralization of Special Elements used in an SQL Command
S-CMS PHP v1.0 has SQL injection via the 4/js/scms.php?action=unlike id parameter...
Cross site request forgery (csrf)
S-CMS PHP v1.0 has a CSRF vulnerability to add a new admin user via the 4.edu.php/admin/ajax.php?type=admin&action=add&lang=0 URI, a related issue to CVE-2019-9040...
CVE-2019-10237
CVE-2019-10237 affects S-CMS PHP v1.0 and is a CSRF vulnerability that allows adding a new admin user via the URI 4.edu.php/admin/ajax.php?type=admin&action=add&lang=0. The issue is linked to CVE-2019-9040 and reiterates a cross-site request forgery risk in the admin creation flow. Connected Red ...
CVE-2019-10237: Cross-Site Request Forgery (CSRF)
S-CMS PHP v1.0 has a CSRF vulnerability to add a new admin user via the 4.edu.php/admin/ajax.php?type=admin&action=add&lang=0 URI, a related issue to CVE-2019-9040...
Design/Logic Flaw
S-CMS PHP v1.0 has XSS in 4.edu.php via the Sid parameter...
CVE-2019-9925
S-CMS PHP v1.0 has XSS in 4.edu.php via the Sid parameter...
CVE-2019-9925
CVE-2019-9925 affects S-CMS PHP v1.0, with a reflected XSS in the 4.edu.php page via the S_id parameter. Multiple sources (NVD, Red Hat, CNVD, CVE lists) describe a cross-site scripting flaw in S-CMS PHP 1.0 that allows an attacker to execute client-side code by injecting crafted input, typically...
CVE-2019-9925
S-CMS PHP v1.0 has XSS in 4.edu.php via the Sid parameter...
CVE-2019-9925: Improper Neutralization of Input During Web Page Generation
S-CMS PHP v1.0 has XSS in 4.edu.php via the Sid parameter...
CVE-2019-9040
S-CMS PHP v3.0 has a CSRF vulnerability to add a new admin user via the admin/ajax.php?type=admin&action=add URI, a related issue to CVE-2018-19332...
CVE-2019-9040
CVE-2019-9040 affects S-CMS PHP v3.0, reporting a CSRF flaw that allows adding a new admin user via the admin/ajax.php?type=admin&action=add URI (related to CVE-2018-19332). The connected Red Hat/PRION/NVD entries confirm the same vector: CSRF enabling admin user creation. The root cause is impro...
CVE-2019-9040
S-CMS PHP v3.0 has a CSRF vulnerability to add a new admin user via the admin/ajax.php?type=admin&action=add URI, a related issue to CVE-2018-19332...
CVE-2019-9040: Cross-Site Request Forgery (CSRF)
S-CMS PHP v3.0 has a CSRF vulnerability to add a new admin user via the admin/ajax.php?type=admin&action=add URI, a related issue to CVE-2018-19332...