92 matches found
CVE-2023-51048
S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the Anewsauth parameter at /admin/ajax.php...
CVE-2023-51052
S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the Aformauth parameter at /admin/ajax.php...
CVE-2023-29962
S-CMS v5.0 was discovered to contain an arbitrary file read vulnerability...
CVE-2021-26595
In Directus 8.x through 8.8.1, an attacker can learn sensitive information such as the version of the CMS, the PHP version used by the site, and the name of the DBMS, simply by view the result of the api-aa, called automatically upon a connection. NOTE: This vulnerability only affects products th...
CVE-2020-20340
A SQL injection vulnerability in the 4.edu.php\conn\function.php component of S-CMS v1.0 allows attackers to access sensitive database information...
CVE-2019-6805
SQL Injection was found in S-CMS version V3.0 via the alipay/alipayapi.php Oid parameter...
CVE-2011-5303
Cross-site scripting XSS vulnerability in Spitfire CMS 1.0.436 allows remote attackers to inject arbitrary web script or HTML via a cmsusername cookie...
CVE-2020-4040
Bolt CMS before version 3.7.1 lacked CSRF protection in the preview generating endpoint. Previews are intended to be generated by the admins, developers, chief-editors, and editors, who are authorized to create content in the application. But due to lack of proper CSRF protection, unauthorized...
CVE-2024-57095
SQL injection vulnerability in Go-CMS v.1.1.10 allows a remote attacker to execute arbitrary code via a crafted payload...
CVE-2024-57095
Go-CMS v1.1.10 is affected by a SQL injection vulnerability that could allow a remote attacker to execute arbitrary code via a crafted payload. The issue is identified as CVE-2024-57095. The attached metrics indicate a high impact on confidentiality and integrity, with exploitation requiring netw...
CVE-2024-51229
Cross Site Scripting vulnerability in LinZhaoguan pb-cms v.2.0 allows a remote attacker to execute arbitrary code via the theme management function...
CVE-2024-40522
There is a remote code execution vulnerability in SeaCMS 12.9. The vulnerability is caused by phomebak.php writing some variable names passed in without filtering them before writing them into the php file. An authenticated attacker can exploit this vulnerability to execute arbitrary commands and...
CSZ CMS Version 1.3.0 - Authenticated Remote Command Execution Exploit
Exploit Title: CSZ CMS Version 1.3.0 Remote Command Execution Exploit Author: tmrswrr Vendor Homepage: https://www.cszcms.com/ Software Link: https://www.cszcms.com/link/3https://sourceforge.net/projects/cszcms/files/latest/download Version: Version 1.3.0 Tested on:...
CVE-2024-1247 Concrete CMS version 9 before 9.2.5 vulnerable to stored XSS via the Role Name field
Concrete CMS version 9 before 9.2.5 is vulnerable to stored XSS via the Role Name field since there is insufficient validation of administrator provided data for that field. A rogue administrator could inject malicious code into the Role Name field which might be executed when users visit the...
CVE-2023-51049
S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the Abbsauth parameter at /admin/ajax.php...
PT-2023-31748 · S Cms · S-Cms
Name of the Vulnerable Software and Affected Versions: S-CMS version 5.0 Description: The issue is related to a SQL injection vulnerability. It can be exploited via the A newsauth parameter at the "/admin/ajax.php" API endpoint. Recommendations: For S-CMS version 5.0, consider restricting access ...
CVE-2023-51052
S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the Aformauth parameter at /admin/ajax.php...
PT-2023-8104 · Otcms · Otcms
Name of the Vulnerable Software and Affected Versions: OTCMS version 7.01 Description: A critical issue was found in OTCMS, related to the lack of protection for the SQL query structure. This allows a remote attacker to gain unauthorized access to protected information. The issue is associated wi...
PT-2023-28817 · Iteachyou · Iteachyou Dreamer Cms
Name of the Vulnerable Software and Affected Versions: itechyou dreamer CMS version 4.1.3 Description: A Directory Traversal issue allows a remote attacker to execute arbitrary code via the themePath in the uploaded template function. Recommendations: For itechyou dreamer CMS version 4.1.3, updat...