CVE-2018-13445

An issue was discovered in SeaCMS 6.61. There is a CSRF vulnerability that can add a user account via adm1n/adminmanager.php?action=add...

HongCMS Arbitrary Script File Upload Vulnerability

HongCMS is an open source lightweight content management system CMS. HongCMS 3.0.0 suffers from an arbitrary script file upload vulnerability. An attacker can exploit this vulnerability by uploading arbitrary script files via admin/index.php/template/upload URI to execute PHP code...

CVE-2018-11556

tificc in Little CMS 2.9 has an out-of-bounds write in the cmsPipelineCheckAndRetreiveStages function in cmslut.c in liblcms2.a via a crafted TIFF file. NOTE: Little CMS developers do consider this a vulnerability because the issue is based on an sample program using LIBTIFF and do not apply to t...

Design/Logic Flaw

Frog CMS 0.9.5 has XSS via the admin/?/page/edit pagekeywords parameter, aka Edit Page Metadata...

Design/Logic Flaw

joyplus-cms 1.6.0 has XSS in manager/adminvod.php via the keyword parameter...

CVE-2018-9926

An issue was discovered in WUZHI CMS 4.1.0. There is a CSRF vulnerability that can add an admin account via index.php?m=core&f=power&v=add...

idreamsoft iCMS SQL Injection Vulnerability

idreamsoft iCMS is an open source content management system CMS based on PHP and MySQL. A SQL injection vulnerability exists in idreamsoft iCMS 7.0.7 and earlier versions. A remote attacker can exploit this vulnerability to execute arbitrary SQL commands with the 'pid' array parameter in the...

SQL Injection Vulnerability in cms js/comments.php File

Search once cms video program is a set of ASP + MSSQL/ACCESS PHP + MYSQL environment to build an intelligent station-building system. Search once cms v1.6 php version of the js/comments.php file there is a sql injection vulnerability, an attacker can use the vulnerability to obtain database...

SQL Injection Vulnerability in iZhanCMS v2.1 GoodsController.php Page

Station CMS is an open source and free CMS content management system. iZhanCMS v2.1 SQL injection vulnerability exists in the GoodsController.php page, which can be exploited by attackers to obtain sensitive information from the database...

Arbitrary Code Write Vulnerability in SeaCMS admin/admin_weixin.php File

SeaCMS is a free and open source web content management system written in PHP. The system has been designed primarily to manage video-on-demand resources. An arbitrary code write vulnerability exists in the admin/adminweixin.php file in SeaCMS version v6.5.8, which can be exploited by an attacker...

CVE-2017-16941

October CMS through 1.0.428 does not prevent use of .htaccess in themes, which allows remote authenticated users to execute arbitrary PHP code by downloading a theme ZIP archive from /backend/cms/themes, and then uploading and importing a modified archive with two new files: a .php file and a...

Cross-site Scripting (XSS)

October CMS is vulnerable to cross-site scripting XSS attacks. The library does not properly sanitize the brand logo image name, allowing a malicious user to inject and execute arbitrary Javascript...

CVE-2017-1000193

October CMS build 412 is vulnerable to stored WCI a.k.a XSS in brand logo image name resulting in JavaScript code execution in the victim's browser...

CVE-2017-1000193

October CMS build 412 is vulnerable to stored WCI a.k.a XSS in brand logo image name resulting in JavaScript code execution in the victim's browser...

CVE-2017-1000119

October CMS build 412 is vulnerable to PHP code execution in the file upload functionality resulting in site compromise and possibly other applications on the server...

CVE-2017-14600

Pragyan CMS v3.0 is vulnerable to an Error-Based SQL injection in cms/admin.lib.php via $GET'delblack', resulting in Information Disclosure...

Design/Logic Flaw

Vulnerability in wordpress plugin wp2android-turn-wp-site-into-android-app v1.1.4, The plugin includes unlicensed vulnerable CMS software from http://www.invedion.com...

Reflected Cross-site Scripting Vulnerability in Flash cms \module\other\member\data.asp Page

Flash Flash cms is Zibo Flash Network Technology Co., Ltd. developed a corporate website system. A reflective cross-site scripting vulnerability exists in the Flash cms \module\other\member\data.asp page. Allows an attacker to construct XSS statements to perform pop-up box operations and obtain...

SQL injection vulnerability in the 'upId' parameter on the 'menuShowing.php' page of the CMS system of Tai'an Dexion Network Technology.

Tai'an Dexin Network Technology is a comprehensive network service center to provide modern network services, for government agencies, enterprises and institutions and the majority of individual users to provide website construction, website production, domain name registration, web hosting,...

Fastspot BigTree CMS SQL Injection Vulnerability (CNVD-2017-08704)

Fastspot BigTree CMS is the United States Fastspot company based on PHP and MySQL open source content management system CMS. Fastspot BigTree CMS 4.2.18 and earlier versions of the core\admin\modules\developer\extensions\install\process.php file and core\admin\modules\developer\ An SQL injection...