ImpressCMS 1.4.2 - Remote Code Execution (Authenticated) Exploit

Exploit Title: ImpressCMS 1.4.2 - Remote Code Execution RCE Authenticated Exploit Author: Halit AKAYDIN hLtAkydn Vendor Homepage: https://www.impresscms.org/ Software Link: https://www.impresscms.org/modules/downloads/ Version: 1.4.2 Category: Webapps Tested on: Linux/Windows ImpressCMS is a...

Drupal QuickEdit module 跨站请求伪造漏洞

Drupal is an open source content management system developed in PHP by the Drupal community. A cross-site request forgery vulnerability exists in the Drupal QuickEdit module, which allows a remote attacker to trick a victim into visiting a specially crafted web page and performing arbitrary actio...

ZKEACMS code issue vulnerability

ZKEACMS is an open source visually designed, WYSIWYG content management system. version 3.2.0 of ZKEACMS contains a security vulnerability that stems from an arbitrary file upload vulnerability in the application's "/admin/media/upload", which could be exploited to execute arbitrary code via a...

KiteCMS arbitrary file upload vulnerability

KiteCMS is a content management system based on think php. An arbitrary file upload vulnerability exists in /admin/upload/uploadfile in KiteCMS version 1.1. An attacker can exploit the vulnerability getshell via a specially crafted PHP file...

Fuel CMS Brute Force Hacking Vulnerability

FUEL CMS is a CodeIgniter-based content management system. A brute-force cracking vulnerability exists in fuel/modules/fuel/controllers/Login.php in Fuel CMS version 1.5.0. An attacker can use this vulnerability to brute-force the administrator's email address...

CVE-2021-39203

WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions authenticated users who don't have permission to view private post types/data can bypass restrictions in the block editor under certain conditions. This...

CVE-2021-39200

WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions output data of the function wpdie can be leaked under certain conditions, which can include data like nonces. It can then be used to perform actions on yo...

Double free

WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions output data of the function wpdie can be leaked under certain conditions, which can include data like nonces. It can then be used to perform actions on yo...

Double free

WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions the widgets editor introduced in WordPress 5.8 beta 1 has improper handling of HTML input in the Custom HTML feature. This leads to stored XSS in the cust...

CVE-2021-39201

WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. Impact The issue allows an authenticated but low-privileged user like contributor/author to execute XSS in the editor. This bypasses the restrictions imposed on users who do n...

CVE-2021-39203

WordPress 5.8 beta was affected: authenticated users could bypass restrictions in the block editor to view private post types/data under certain conditions. The issue is fixed in the final WordPress 5.8 release; no exploitation details are provided beyond the described bypass during testing.

CVE-2021-39203

WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions authenticated users who don't have permission to view private post types/data can bypass restrictions in the block editor under certain conditions. This...

CVE-2021-39202

CVE-2021-39202 affects WordPress during the 5.8 beta phase, where the widget editor’s Custom HTML input was mishandled, enabling stored XSS in the custom HTML widget. The issue is tied to the beta period of WordPress 5.8 and has been patched in WordPress 5.8. Affected details in provided document...

CVE-2021-39201

WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. Impact The issue allows an authenticated but low-privileged user like contributor/author to execute XSS in the editor. This bypasses the restrictions imposed on users who do n...

CVE-2021-39201

CVE-2021-39201 affects WordPress and allows an authenticated, low-privileged user (e.g., contributor/author) to trigger cross-site scripting in the editor by bypassing the unfiltered_html restriction. The issue is fixed in WordPress 5.8; older versions are expected to receive patches via minor re...

dotCMS file upload vulnerability

dotCMS is a powerful Java-based content management system CMS. dotCMS 5.2.3 and earlier versions are vulnerable to file uploads. A remote attacker can exploit this vulnerability to execute arbitrary code via /src/main/java/com/dotmarketing/filters/CMSFilter.java...

EyouCMS Cross-Site Scripting Vulnerability (CNVD-2021-82430)

EyouCms is a free and open source enterprise content management system based on the TP5.0 framework that focuses on the needs of enterprise website users. A remote attacker can use the title parameter in the bindemail function to inject arbitrary web script or HTML...

EyouCMS Cross-Site Scripting Vulnerability (CNVD-2021-82428)

EyouCms is a free and open source enterprise content management system based on the TP5.0 framework that focuses on the needs of enterprise website users. The vulnerability stems from the lack of validation of input data in Eyoucms. An attacker could use this vulnerability to inject malicious cod...

The vulnerability of the PopojiCMS content management system arises from the lack of measures taken to protect the website structure. This allows attackers to execute arbitrary web or HTML scripts.

The vulnerability in the /admin.php?mod=user&act=addnew function of the PopojiCMS content management system exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary web or HTML scripts by using a special...

CVE-2021-39192

Ghost is a Node.js content management system. An error in the implementation of the limits service between versions 4.0.0 and 4.9.4 allows all authenticated users including contributors to view admin-level API keys via the integrations API endpoint, leading to a privilege escalation vulnerability...