mipjz 跨站脚本漏洞

mipjz is sansanyun individual developers of a set of Baidu Mobile Accelerator MIP-based content management system . A security vulnerability exists in mipjz version v5.0.5, which stems from a stored cross-site scripting XSS vulnerability that allows an attacker to execute arbitrary web script or...

WUZHI CMS 跨站脚本漏洞

WUZHI CMS is a PHP and MySQL based open source content management system CMS from Wuzhi WUZHI. A security vulnerability exists in Wuzhi CMS version v3.1.2, which stems from a stored XSS vulnerability in the backend...

CVE-2023-31816

IT Sourcecode Content Management System Project In PHP and MySQL With Source Code 1.0.0 is vulnerable to Cross Site Scripting XSS via /ecodesource/searchlist.php...

CVE-2023-31816

The CVE-2023-31816 entry concerns IT Sourcecode Content Management System (PHP/MySQL) v1.0.0 that is vulnerable to Cross-Site Scripting (XSS) via the endpoint /ecodesource/search_list.php. The vulnerability is described across sources (NVD, Red Hat, CVE listings) with the core issue being an XSS ...

WCMS 代码问题漏洞

WCMS is a content management system CMS. A security vulnerability exists in WCMS version 0.3.2. An attacker can use this vulnerability to write arbitrary strings to custom file names and upload arbitrary files, or write malicious code to execute scripts to trigger command execution...

Content Management System 跨站脚本漏洞

SourceCodester Content Management System is a software application. A simple PHP/Library MySQLi to manage the content items of a simple website. A security vulnerability exists in Content Management System version 1.0.0, which originates from an easy cross-site scripting XSS attack via...

CVE-2023-31816

IT Sourcecode Content Management System Project In PHP and MySQL With Source Code 1.0.0 is vulnerable to Cross Site Scripting XSS via /ecodesource/searchlist.php...

LavaLite Cross-Site Scripting Vulnerability (CNVD-2023-41501)

LavaLite is an open source lightweight content management system CMS. A cross-site scripting vulnerability exists in LavaLite version v9.0.0, which stems from the lack of effective filtering and escaping of user-supplied data by the account name, and can be exploited by an attacker to execute...

CVE-2023-32679

Craft CMS is vulnerable to Remote Code Execution due to lack of file extension validation in template resolution (name parameter handling in View.php). Exploitation requires admin privileges on an environment configured for development/staging/production (e.g., ALLOW_ADMIN_CHANGES=true). The issu...

SEMCMS SQL注入漏洞

SEMCMS is a foreign trade web content management system CMS that supports multiple languages. A SQL injection vulnerability exists in SEMCMS version 1.5, which originates from the lack of validation of external input SQL statements in AntRponse.php. An attacker can exploit this vulnerability to...

GuppY 代码问题漏洞

GuppY is a CMS system from France with many modules such as forums, news, messages, downloads and more. A security vulnerability exists in GuppY CMS version 6.00.10, which stems from an unrestricted file upload vulnerability that allows remote attackers to execute arbitrary code by uploading php...

Cross site scripting

Craft CMS is a content management system. Starting in version 3.0.0 and prior to versions 3.8.4 and 4.4.4, a malformed title in the feed widget can deliver a cross-site scripting payload. This issue is fixed in version 3.8.4 and 4.4.4...

CVE-2023-31144

CVE-2023-31144 affects Craft CMS RSS/feed widget title handling. A malformed title can deliver a cross-site scripting payload. Affected versions are 3.0.0–3.8.3 and 4.0.0–4.4.3; the issue is fixed in 3.8.4 and 4.4.4. Public references from Craft CMS advisories and GitHub GHSA confirm the XSS, wit...

CVE-2020-22755

File upload vulnerability in MCMS 5.0 allows attackers to execute arbitrary code via a crafted thumbnail. A different vulnerability than CVE-2022-31943...

BEESCMS 跨站请求伪造漏洞

BEESCMS is a PHP and MySQL based, scalable content management system CMS. A security vulnerability exists in version v4 of BEESCMS that stems from the presence of a cross-site request forgery CSRF vulnerability that allows an attacker to delete an administrator account via a crafted request...

PT-2023-22497 · S Cms · S-Cms

Name of the Vulnerable Software and Affected Versions: S-CMS version 5.0 Description: The issue is related to an authenticated remote code execution RCE vulnerability. It can be exploited via the /admin/ajax.php API endpoint. Recommendations: For S-CMS version 5.0, consider disabling access to th...

S-CMS 安全漏洞

S-CMS is a PHP and MySQL based Content Management System CMS from S-CMS, China. A security vulnerability exists in S-CMS version v5.0, which originated from the discovery of a remote code execution RCE vulnerability contained via component/admin/ajax.php...

CLTPHP Input Validation Error Vulnerability

CLTPHP is an open source and efficient site-building PHP content management system. An input validation error vulnerability exists in CLTPHP version 6.0 and earlier versions, which stems from incorrect input validation in application/admin/controller/Template.php. An attacker can exploit this...

CLTPHP 路径遍历漏洞

CLTPHP is an open source PHP content management system for efficient website building. A security vulnerability exists in CLTPHP 6.0 and earlier versions, which stems from the presence of incorrect input validation...

Desdev DedeCMS 代码问题漏洞

Desdev DedeCMS Dream Weaving Content Management System is a PHP-based open-source content management system CMS of China Zhuozhuo network Desdev company. The system has features such as content publishing, content management, content editing and content retrieval. A code issue vulnerability exist...