CVE-2019-17536

Gila CMS through 1.11.4 allows Unrestricted Upload of a File with a Dangerous Type via the moveAction function in core/controllers/fm.php. The attacker needs to use admin/mediaupload and fm/move...

CVE-2020-11069

In TYPO3 CMS 9.0.0 through 9.5.16 and 10.0.0 through 10.4.1, it has been discovered that the backend user interface and install tool are vulnerable to a same-site request forgery. A backend user can be tricked into interacting with a malicious resource an attacker previously managed to upload to...

CVE-2024-29022

Xibo is an Open Source Digital Signage platform with a web content management system and Windows display player software. In affected versions some request headers are not correctly sanitised when stored in the session and display tables. These headers can be used to inject a malicious script int...

CVE-2025-0708

A vulnerability was found in fumiao opencms 2.2. It has been declared as problematic. This vulnerability affects unknown code of the file /admin/model/addOrUpdate of the component Add Model Management Page. The manipulation of the argument 模板前缀 leads to cross site scripting. The attack can be...

GO-CMS 安全漏洞

GO-CMS is an RBAC-based privilege management system by the individual developer Xiaoyuer Xi-Yuer. A security vulnerability exists in GO-CMS version v.1.1.10, which stems from the presence of a SQL injection vulnerability that allows remote attackers to execute arbitrary code via a crafted payload...

CVE-2024-57095

SQL injection vulnerability in Go-CMS v.1.1.10 allows a remote attacker to execute arbitrary code via a crafted payload...

CVE-2024-55488

A stored cross-site scripting XSS vulnerability in Umbraco CMS v14.3.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. NOTE: This has been disputed by the vendor since this potential attack is only possible via authenticated users who have been manually allowed...

CVE-2025-24011

Umbraco is a free and open source .NET content management system. Starting in version 14.0.0 and prior to versions 14.3.2 and 15.1.2, it's possible to determine whether an account exists based on an analysis of response codes and timing of Umbraco management API responses. Versions 14.3.2 and...

CVE-2025-24011 Umbraco CMS Vulnerable to User Enumeration Feasible Based On Management API Timing and Response Codes

Umbraco is a free and open source .NET content management system. Starting in version 14.0.0 and prior to versions 14.3.2 and 15.1.2, it's possible to determine whether an account exists based on an analysis of response codes and timing of Umbraco management API responses. Versions 14.3.2 and...

CVE-2024-47605

silverstripe-asset-admin is a silverstripe assets gallery for asset management. When using the "insert media" functionality, the linked oEmbed JSON includes an HTML attribute which will replace the embed shortcode. The HTML is not sanitized before replacing the shortcode, allowing a script payloa...

CVE-2025-22389

An issue was discovered in Optimizely EPiServer.CMS.Core before 12.32.0. A medium-severity vulnerability exists in the CMS, where the application does not properly validate uploaded files. This allows the upload of potentially malicious file types, including .docm .html. When accessed by...

Exploit for Path Traversal in Ghost

CVE-2023-4002 Ghost-Arbitrary-File-Read : The username/email...

CVE-2024-55341

CVE-2024-55341 is a stored XSS vulnerability in Piranha CMS 11.1 where an attacker can inject JavaScript by creating a page via /manager/pages and adding Markdown content. The issue originates from the /manager/pages Markdown content handling and can lead to arbitrary script execution in a user’s...

Craft CMS has potential RCE when PHP `register_argc_argv` config setting is enabled

Impact You are affected if your php.ini configuration has registerargcargv enabled. Patches Update to 3.9.14, 4.13.2, or 5.5.2. Workarounds If you can't upgrade yet, and registerargcargv is enabled, you can disable it to mitigate the issue...

Exploit for Path Traversal in Ghost

Proof of Concept PoC for CVE-2023-40028 CVE-2023-40028 is a...

CVE-2023-43962

Cross Site Scripting vulnerability in Xunrui CMS Public Edition v.4.6.1 allows a remote attacker to execute arbitrary code via the project name function in the project settings tab...

PT-2024-35410 · Hkcms · Hkcms

Name of the Vulnerable Software and Affected Versions: HkCms versions prior to 2.3.2.240702 Description: The issue concerns a file upload vulnerability in the getFileName method located in /app/common/library/Upload.php. Recommendations: For versions prior to 2.3.2.240702, consider disabling the...

Cross-Site Scripting (XSS)

umbraco.cms.core is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper handling of the argument culture in the file /Umbraco/preview/frame?id of the Dashboard component, which allows remote attackers to manipulate the argument and execute malicious scripts...

wtcms 安全漏洞

wtcms is a ThinkPHP-based content management system CMS by Taosir Personal Developer. A security vulnerability exists in version 1.0 of wtcms, which stems from vulnerability to a false access control attack in the file CommonControllerHomebaseController.class.php...

PT-2024-33184 · Unknown · Kliqqi-Cms

Name of the Vulnerable Software and Affected Versions: Kliqqi-CMS affected versions not specified Description: The issue allows attackers to execute arbitrary code in the background, potentially leading to the implantation of backdoors or gaining shell access. This is achieved through exploitatio...