CVE-2024-29181 @strapi/plugin-content-manager leaks data via relations via the Admin Panel

Strapi is an open-source content management system. Prior to version 4.19.1, a super admin can create a collection where an item in the collection has an association to another collection. When this happens, another user with Author Role can see the list of associated items they did not create...

The functionality of the pages.php component in the Content Management System allows a hacker to execute arbitrary code or enhance their privileges.

The vulnerability of the pages.php component in the Content Management System software is related to the failure to implement measures to protect the SQL query structure. Exploiting this vulnerability allows an attacker to execute arbitrary code or gain increased privileges...

CVE-2024-37160 Formwork has a Cross-site scripting (XSS) vulnerability in Description metadata

Formwork is a flat file-based Content Management System CMS. An attackers requires administrator privilege to execute arbitrary web scripts by modifying site options via /panel/options/site. This type of attack is suitable for persistence, affecting visitors across all pages except the dashboard...

Formwork Cross-Site Scripting Vulnerability

Formwork is Formwork open source a flat file based content management system CMS. It is used to build and manage simple websites. A cross-site scripting vulnerability exists in Formwork versions prior to 1.13.1, which originates from a vulnerability that allows an attacker to execute arbitrary we...

The vulnerability of the /ms/file/upload.do file in the MCms content management system allows a hacker to upload any files they desire.

The vulnerability of the /ms/file/upload.do file in the MCms content management system is related to the ability to download files of a dangerous type without restrictions. Exploiting this vulnerability allows a malicious actor to download any files by sending a specially crafted POST request...

CVE-2024-35228

Wagtail is an open source content management system built on Django. Due to an improperly applied permission check in the wagtail.contrib.settings module, a user with access to the Wagtail admin and knowledge of the URL of the edit view for a settings model can access and update that setting, eve...

CVE-2024-35228 Improper Handling of Insufficient Permissions in Wagtail

Wagtail is an open source content management system built on Django. Due to an improperly applied permission check in the wagtail.contrib.settings module, a user with access to the Wagtail admin and knowledge of the URL of the edit view for a settings model can access and update that setting, eve...

MinMax CMS 安全漏洞

MinMax CMS is a content management system. A security vulnerability exists in MinMax CMS that stems from the application containing a hidden administrator account with a fixed password that cannot be removed or disabled from the administrative interface...

PT-2024-40536 · Packagist · Silverstripe/Framework

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned. Description: A security issue allows a member with the EDIT PERMISSIONS permission and access to the "Security" section to escalate their privileges to ADMIN level by re-assigning themselves or...

PT-2024-40381 · Microsoft · Office Excel

Name of the Vulnerable Software and Affected Versions: CMS affected versions not specified Description: The issue concerns the CSV export feature of the CMS, where the output can contain macros and scripts. If these are imported into software like Microsoft Excel without proper sanitization, they...

PT-2024-40450 · Unknown · Virtualpage

Name of the Vulnerable Software and Affected Versions: VirtualPage affected versions not specified Description: A cross-site scripting issue has been found in the VirtualPage class. This can be exploited if a user with CMS access posts malicious or unescaped HTML into any of the text fields of a...

PT-2024-40127 · Packagist · Silverstripe Cms

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned. Description: A cross-site scripting issue has been found in the CMS page history tab. This can be exploited if a user with CMS access posts malicious or unescaped HTML into any text fields on a...

Umbraco CMS 跨站脚本漏洞

Umbraco CMS is a content management system from Umbraco, Denmark. A security vulnerability exists in Umbraco CMS that stems from the presence of stored cross-site scripting XSS, which enables an attacker to bring malicious content into a website or application...

Umbraco CMS 安全漏洞

Umbraco CMS is a content management system from Umbraco, Denmark. A security vulnerability exists in Umbraco CMS that stems from vulnerability to open redirects...

Grav 安全漏洞

Grav is an extensible CMS Content Management System for personal blogs, small content publishing platforms, and one-page product presentations. A security vulnerability exists in Grav versions prior to 1.7.46. An attacker exploited the vulnerability to compromise any registered account and read a...

The vulnerability of the CMS system Netcat, related to the lack of measures taken to protect the website structure, allows attackers to carry out XSS attacks.

The vulnerability of the CMS system Netcat is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks...

The vulnerability of the CMS system Netcat, related to the lack of restrictions on file downloads, allows attackers to execute arbitrary code or cause service interruptions.

The vulnerability of the CMS system Netcat is related to the lack of restrictions on file downloads. Exploiting this vulnerability allows a malicious actor to execute arbitrary code or cause service failures...

CVE-2024-34355

TYPO3 is an enterprise content management system. Starting in version 13.0.0 and prior to version 13.1.1, the history backend module is vulnerable to HTML injection. Although Content-Security-Policy headers effectively prevent JavaScript execution, adversaries can still inject malicious HTML...

CVE-2024-34355

TYPO3 history backend module (software: TYPO3) is affected in versions 13.0.0 up to 13.1.0. The vulnerability is an HTML injection flaw in historyRow.title that persists despite CSP headers; exploitation requires a valid backend user account. The issue is resolved in TYPO3 v13.1.1. Connected advi...

Jin Fang Times Content Management System 安全漏洞

Jin Fang Times Content Management System is a content management system from Jin Fang Times. A security vulnerability exists in Jin Fang Times Content Management System version v3.2.3, which originates from a SQL injection vulnerability via the id parameter...