CVE-2024-10290

A vulnerability, which was classified as problematic, was found in ZZCMS 2023. This affects an unknown part of the file 3/qq-connect2.0/API/com/inc.php. The manipulation leads to information disclosure. It is possible to initiate the attack remotely. The exploit has been disclosed to the public a...

Remote Code Execution

Camaleon CMS is vulnerable to Remote Code Execution. The vulnerability is due to insufficient file handling in the MediaController's upload method, allowing authenticated users to write arbitrary files to any location on the server, depending on filesystem permissions. This can potentially lead t...

CVE-2024-44820

A sensitive information disclosure vulnerability exists in ZZCMS v.2023 and before within the eginfo.php file located at /3/Ebak5.1/upload/. When accessed with the query parameter phome=ShowPHPInfo, the application executes the phpinfo function, which exposes detailed information about the PHP...

SeaCMS 安全漏洞

SeaCMS is a free, open source web content management system written in PHP by SeaCMS, Inc. The system is primarily designed to manage video-on-demand resources. A security vulnerability exists in SeaCMS v12.9, which stems from improper handling of the id parameter in the...

The vulnerability of the Netcat module in CMS systems allows a hacker to execute arbitrary JavaScript code.

The vulnerability of the Netcat landing module in CMS systems exists due to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability allows a malicious actor to execute arbitrary JavaScript code in the user’s browser remotely...

CVE-2024-42607

Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery CSRF vulnerability via /admin/adminbackup.php?dobackup=database...

PT-2024-76: Time-based SQL Injection in Netcat CMS (module comments)

The vulnerability was identified in Netcat CMS module comments, version 6.4 Extra. The discovered vulnerability allows an attacker to read information from the database. Vulnerability status: Confirmed by vendor Date of vulnerability remediation: 20.08.2024 Recommendations: Update to version or...

CVE-2024-42613

Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery CSRF vulnerability via /admin/adminwidgets.php?action=install&widget=akismet...

CVE-2024-7657

A vulnerability classified as problematic was found in Gila CMS 1.10.9. This vulnerability affects unknown code of the file /cm/updaterows/page?id=2 of the component HTTP POST Request Handler. The manipulation of the argument content leads to cross site scripting. The attack can be initiated...

Craft CMS Access Control Error Vulnerability

Craft CMS is Craft CMS open source content management system CMS. An access control error vulnerability exists in Craft CMS versions 5.0.0-beta.1 through 5.2.2, which stems from allowing multiple reuses of a TOTP token during its validity period. An attacker can exploit the vulnerability by...

CVE-2024-30419

A-blog cms contains a stored cross-site scripting (XSS) vulnerability: CVE-2024-30419 affects versions prior to 3.1.12, 3.0.x prior to 3.0.32, 2.11.x prior to 2.11.61, 2.10.x prior to 2.10.53, and 2.9 and earlier. If exploited, a user with contributor or higher privileges who can log in may cause...

idccms 安全漏洞

Net Titanium Technology idcCMS Net Titanium IDC Cloud Management Agent System is a cloud management agent system from China's Net Titanium Technology Net Titanium Technology. A security vulnerability exists in idccms v1.35, which was discovered via the component...

CVE-2024-32418

CVE-2024-32418 describes a remote code execution in flusity CMS v2.33 via the add_addon.php component. The issue arises in that specific component, enabling a remote attacker with network access and no authentication to run arbitrary code with high impact on affected installations. Public details...

CVE-2024-31666

An issue in flusity-CMS v.2.33 allows a remote attacker to execute arbitrary code via a crafted script to the editaddonpost.php component...

The vulnerability of the CMS system Netcat, which stems from the lack of protective measures for website structures, allows attackers to gain unauthorized access to the system.

The vulnerability of the CMS system Netcat is related to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to the system...

CVE-2024-30614

CVE-2024-30614 affects Ametys CMS v4.5.0 and earlier. The issue allows attackers to obtain sensitive information by exposing resources to the error scope, indicating a faulty error handling/resource exposure in the CMS. Red Hat and CNNVD corroborate the same description; PT Security recommends up...

CVE-2024-30614

An issue in Ametys CMS v4.5.0 and before allows attackers to obtain sensitive information via exposed resources to the error scope...

CVE-2024-2753

Concrete CMS version 9 before 9.2.8 and previous versions prior to 8.5.16 is vulnerable to Stored XSS on the calendar color settings screen since Information input by the user is output without escaping. A rogue administrator could inject malicious javascript into the Calendar Color Settings scre...

CVE-2024-3180

Concrete CMS CVE-2024-3180 describes a Stored XSS in blocks of type file. A rogue administrator can inject malicious code into the link-text field when creating a file block, affecting Concrete CMS versions 9.0.0–9.2.7 and 8.5.15 and earlier. Root cause is insufficient input sanitization in the f...

CVE-2024-3146

A vulnerability classified as problematic has been found in DedeCMS 5.7. This affects an unknown part of the file /src/dede/makehtmlrssaction.php. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and...