Exploit for Deserialization of Untrusted Data in Magnolia-Cms Magnolia_Cms

CVE-2021-46364: YAML Deserialization in Magnolia CMS Magnolia...

PT-2023-30869 · Unknown · Concrete Cms

Name of the Vulnerable Software and Affected Versions: Concrete CMS versions prior to 8.5.13 Concrete CMS versions 9.x prior to 9.2.2 Description: The issue allows for stored XSS on the Admin page via an uploaded file name. Recommendations: For versions prior to 8.5.13, update to version 8.5.13 o...

Dreamer CMS Security Vulnerability

Dreamer CMS is a Dreamer Content Management System by Junnan Wang, an individual developer in China. A security vulnerability exists in Dreamer CMS version 4.1.3, which stems from a cross-site request forgery CSRF vulnerability. The vulnerability can be exploited by an attacker to delete a theme...

The vulnerability of the SPIP content management system, related to the restoration of unreliable data in memory, allows a hacker to execute arbitrary code.

The vulnerability of the SPIP content management system is related to the restoration of unreliable data in memory. Exploiting this vulnerability allows a malicious actor, operating remotely, to execute arbitrary code using specially created data transmitted to the application...

PT-2023-32331

Name of the Vulnerable Software and Affected Versions flusity CMS affected versions not specified Description A vulnerability was found in flusity CMS, classified as problematic, affecting the function loadCustomBlocCreateForm of the file /core/tools/customblock.php in the component Dashboard. Th...

DedeBIZ 安全漏洞

DedeBIZ is a content management system from China Muyun Intelligent Technology DedeBIZ company. A code execution vulnerability exists in DedeBIZ version v6.2.11, which stems from the $activepath and $filename parameters in /admin/filemanagecontrol.php failing to correctly filter the special...

The vulnerability of the file_pic_view.php component in the DedeCMS content management system, related to the lack of protective measures for website structures, allows attackers to carry out XSS attacks.

The vulnerability of the filepicview.php component in the DedeCMS content management system is related to the lack of measures taken to protect the website’s structure. Exploiting this vulnerability allows a malicious actor to perform XSS attacks remotely...

Impress CMS 1.3.9 Open Redirection

==================================================================================================================================== | Title : impress CMS v1.3.9 Open Redirect vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox 63.0.3 32-bit ...

CVE-2023-39650

Theme Volty CMS Blog up to version v4.0.1 was discovered to contain a SQL injection vulnerability via the id parameter at /tvcmsblog/single...

PT-2023-27926 · Unknown · Crafter Cms

Name of the Vulnerable Software and Affected Versions: CrafterCMS versions 3.1.0 through 3.1.27 CrafterCMS versions 4.0.0 through 4.0.2 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS...

Pluck CMS 代码注入漏洞

Pluck is a content management system CMS developed using the PHP language. A security vulnerability exists in Pluck CMS version 4.7.10-dev2, which originates from a vulnerability that allows an attacker to execute arbitrary php code via the hidden parameter of admin.php while editing a page...

Cross site scripting

Craft is a CMS for creating custom digital experiences on the web.The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload. Old CVE fixed the XSS in label HTML but didn’t fix it when clicking save. This issue was patched in...

CVE-2023-30145

Camaleon CMS v2.7.0 was discovered to contain a Server-Side Template Injection SSTI vulnerability via the formats parameter...

Vulnerability of the built-in code editor of the content management system (CMS) 1C-Bitrix: Site management related to input data processing errors, allowing attackers to execute arbitrary code

Vulnerability of the built-in code editor of the content management system CMS 1C-Bitrix: Website management is associated with errors in data input processing. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2023-27237

LavaLite CMS v 9.0.0 was discovered to be vulnerable to a host header injection attack...

CVE-2023-2582

A prototype pollution vulnerability exists in Strikingly CMS which can result in reflected cross-site scripting XSS in affected applications and sites built with Strikingly. The vulnerability exists because of Strikingly JavaScript library parsing the URL fragment allows access to the proto or...

CVE-2023-29963

S-CMS v5.0 was discovered to contain an authenticated remote code execution RCE vulnerability via the component /admin/ajax.php...

OURPHP 跨站脚本漏洞

OURPHP is OURPHP open source an open source , cross-platform , enterprise-class + e-commerce + applet + APP multi-terminal synchronization CMS station-building system . OURPHP version 7.2.0 and previous versions of security vulnerabilities , the vulnerability stems from the file ourphpout.php fou...

CVE-2023-1483

A vulnerability has been found in XiaoBingBy TeaCMS up to 2.0.2 and classified as critical. This vulnerability affects unknown code of the file /admin/getallarticleinfo. The manipulation of the argument searchInfo leads to sql injection. The attack can be initiated remotely. VDB-223366 is the...

CVE-2023-1398

A vulnerability classified as critical was found in XiaoBingBy TeaCMS 2.0. Affected by this vulnerability is an unknown functionality of the file /admin/upload. The manipulation leads to path traversal: '../filedir'. The attack can be launched remotely. The exploit has been disclosed to the publi...