Navigate CMS Cross-Site Scripting Vulnerability (CNVD-2021-57428)

A cross-site scripting vulnerability exists in Navigate CMS version 2.9, which is a powerful and intuitive content management system. The vulnerability can be exploited to conduct cross-site scripting attacks via the name="wrongpathredirect" function...

CVE-2021-37393

In RPCMS v1.8 and below, the "nickname" variable is not properly sanitized before being displayed on page. Attacker can use "update password" function to inject XSS payloads into nickname variable, and achieve stored XSS. Users who view the articles published by the injected user will trigger the...

NavigateCMS SQL注入漏洞

Navigate CMS is a powerful and intuitive content management system. A sql injection vulnerability exists in the products-order parameter in products.php in Navigate CMS 2.9.4 and earlier versions. An attacker can exploit this vulnerability to execute arbitrary sql queries in the backend database...

Evolution CMS 跨站脚本漏洞

Evolution CMS is an open source PHP-based content management system CMS. A cross-site scripting vulnerability exists in Evolution CMS version 2.0.2, which can be exploited by an attacker to cause a cross-site scripting vulnerability via the Document Manager feature...

Victor CMS arbitrary file upload vulnerability

Victor CMS is an open source content management system from the developers of Victor Alagwu Software in Nigeria. version 1.0 of Victor CMS is vulnerable to arbitrary file uploads. An attacker can execute arbitrary code by uploading files to CMS site-masteradminincludesadminaddpost.php...

UCMS 信息泄露漏洞

UCMS is a content management system written in PHP. UCMS 1.5.0 contains a security vulnerability that stems from an error message returned by the adminchannelscache function in top.php that contains a physical path leak. No details of the vulnerability are currently available...

Sourcecodester Simple College Website SQL Injection Vulnerability

Sourcecodester Simple College Website is a Sourcecodester open source application. A content management system. SourceCodester Simple College Website v 1.0 is vulnerable to SQL injection, which can be exploited by remote attackers to execute arbitrary SQL statements against news.php via the id...

PbootCMS Access Control Error Vulnerability

PbootCMS is an open source enterprise website content management system CMS developed using the PHP language.The message board of PbootCMS 2.0.6 is vulnerable to an access control error. An attacker can exploit the access control error vulnerability by executing the list parameter in the update...

CVE-2021-25197

Cross-site scripting XSS vulnerability in SourceCodester Content Management System v 1.0 allows remote attackers to inject arbitrary web script or HTML via the search parameter to contentmanagementsystem\admin\newcontent.php...

CVE-2021-25197

Cross-site scripting XSS vulnerability in SourceCodester Content Management System v 1.0 allows remote attackers to inject arbitrary web script or HTML via the search parameter to contentmanagementsystem\admin\newcontent.php...

CVE-2021-26231

SQL injection vulnerability in SourceCodester Fantastic Blog CMS v 1.0 allows remote attackers to execute arbitrary SQL statements, via the id parameter to category.php...

SourceCodester Content Management System 跨站脚本漏洞

SourceCodester Content Management System is an application. A simple PHP/library MySQLi to manage content items for a simple website. sourceCodester Content Management System has a security vulnerability that can be exploited by remote attackers to inject arbitrary web scripts or HTML...

TYPO3 Cross-Site Scripting Vulnerability (CNVD-2022-17987)

TYPO3 is a free and open source content management system framework CMS/CMF from the TYPO3 Typo3 association in Switzerland.TYPO3 suffers from a cross-site scripting vulnerability that stems from the fact that when the settings of the back-end layout are not properly coded, the corresponding grid...

CVE-2021-32669

TYPO3 is an open source PHP based web content management system. Versions 9.0.0 through 9.5.28, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0 have a cross-site scripting vulnerability. When settings for backend layouts are not properly encoded, the corresponding grid view is vulnerable to...

CVE-2021-32767

TYPO3 Information Disclosure (CVE-2021-32767) affects TYPO3 CMS versions 9.0.0–9.5.27, 10.0.0–10.4.17, and 11.0.0–11.3.0, where user credentials may be logged in plaintext when debug logging is explicitly enabled (not the default). A patch exists in TYPO3 9.5.28, 10.4.18, and 11.3.1. Connected ad...

CVE-2021-32767 Information Disclosure in User Authentication

TYPO3 is an open source PHP based web content management system. In versions 9.0.0 through 9.5.27, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0, user credentials may been logged as plain-text. This occurs when explicitly using log level debug, which is not the default configuration. TYPO3...

CVE-2021-32669

CVE-2021-32669 affects TYPO3 CMS: multiple versions (9.0.0–9.5.28, 10.0.0–10.4.17, 11.0.0–11.3.0) are vulnerable to persistent cross-site scripting in the grid view when backend layouts settings aren’t properly encoded. A valid backend user is required to exploit it. TYPO3 fixed this in versions ...

CVE-2021-32669 Cross-Site Scripting in Backend Grid View

TYPO3 is an open source PHP based web content management system. Versions 9.0.0 through 9.5.28, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0 have a cross-site scripting vulnerability. When settings for backend layouts are not properly encoded, the corresponding grid view is vulnerable to...

Cross site scripting

TYPO3 is an open source PHP based web content management system. Versions 9.0.0 through 9.5.28, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0 have a cross-site scripting vulnerability. When Page TSconfig settings are not properly encoded, corresponding page preview module WebView is vulnerabl...

CVE-2021-32668

TYPO3-CORE-SA-2021-010/CVE-2021-32668 affects TYPO3 CMS versions 9.0.0–9.5.28, 10.0.0–10.4.17, and 11.0.0–11.3.0. The vulnerability is a cross-site scripting (XSS) flaw in the QueryGenerator and QueryView components that occurs when error messages are not properly encoded, enabling reflected and ...