Shield CMS 2.2 - email SQL Injection

Shield CMS 2.2 - email SQL Injection Exploit Title: SHIELD - Freelancer Content Management System 2.2 - SQL Injection / CSRF Dork: N/A Date: 2019-01-10 Exploit Author: Ihsan Sencan Vendor Homepage: http://ezcode.pt/ Software Link:...

ThreatList: WordPress Vulnerabilities Up 30 Percent in 2018

UPDATE Vulnerabilities in popular content management system CMS WordPress are growing at a rapid rate, up 30 percent in 2018, according to new web application bug research released Wednesday. Researchers at Imperva said that in 2018, they continued to see a trend of increasing web application...

Multiple Cross-Site Scripting Vulnerabilities in Zenphoto

Zenphoto is a free photo gallery content management system developed by the Zenphoto team. The system manages images and supports multimedia such as audio and video. Zenphoto suffers from multiple cross-site scripting vulnerabilities. A remote attacker can exploit this vulnerability to inject...

Family Connections Has Multiple Cross-Site Scripting Vulnerabilities

Family Connections is an open source content management system that makes it easy and convenient to create private family sites. Family Connections suffers from multiple cross-site scripting vulnerabilities. An attacker can construct XSS statements and perform pop-up box operations to obtain user...

GeniXCMS 1.1.5 Cross-Site Scripting Attack Vulnerability

MetalGenix GeniXCMS is a PHP-based content management system and framework CMSF from MetalGenix Indonesia, which provides modules for user management, content management and menu management. A cross-site scripting vulnerability exists in MetalGenix GeniXCMS version 1.1.5. A remote attacker can...

XSLT CMS Cross-Site Scripting Vulnerability

A cross-site scripting vulnerability exists in XSLT CMS, a content management system CMS written in PHP and based on XML and XSL transformations. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML via the title field of the create/?action=items.edit&type=Page...

Ivan Cordoba Generic Content Management System Cross-Site Scripting Vulnerability

Ivan Cordoba Generic Content Management System CMS is a content management system CMS based on MySQL and PHP. A cross-site scripting vulnerability exists in the Administrator/addpictures.php file in Ivan Cordoba Generic CMS on 2018-04-28 and earlier versions, which can be exploited by a remote...

Ivan Cordoba Generic Content Management System SQL Injection Vulnerability (CNVD-2019-16171)

Ivan Cordoba Generic Content Management System CMS is a content management system CMS based on MySQL and PHP. A SQL injection vulnerability in the user/index.php file in Ivan Cordoba Generic CMS on 2018-04-28 and earlier versions can be exploited by remote attackers to bypass authentication...

UCMS cross-site scripting vulnerability (CNVD-2019-00981)

UCMS is a content management system written in PHP. A cross-site scripting vulnerability exists in UCMS version 1.4.7. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML with the help of the 'dir' parameter...

UCMS Cross-Site Request Forgery Vulnerability

UCMS is a content management system written in PHP. A cross-site request forgery vulnerability exists in UCMS version 1.4.7. A remote attacker can exploit this vulnerability to create an administrator account with the help of ?do=useraddpost...

CVE-2018-20598

UCMS 1.4.7 has ?do=useraddpost CSRF...

CVE-2018-20599

UCMS 1.4.7 allows remote attackers to execute arbitrary PHP code by entering this code during an index.php sadminfileedit action...

CVE-2018-20600

sadmin\cedit.php in UCMS 1.4.7 has XSS via an index.php sadmincedit action...

CVE-2018-20597

UCMS 1.4.7 has XSS via the dir parameter in an index.php sadminfileedit action...

CVE-2018-20602

Lei Feng TV CMS aka LFCMS 3.8.6 allows full path disclosure via the /install.php?s=/1 URI...

CVE-2018-20601

UCMS 1.4.7 has XSS via the description parameter in an index.php listeditpost action...

Code injection

Ivan Cordoba Generic Content Management System CMS through 2018-04-28 has XSS via the Administrator/users.php user ID...

CVE-2018-20590

Ivan Cordoba Generic Content Management System CMS through 2018-04-28 has XSS via the Administrator/users.php user ID...

CVE-2018-20589

Ivan Cordoba Generic Content Management System CMS through 2018-04-28 has XSS via the Administrator/addpictures.php article ID...

CVE-2018-20590

CVE-2018-20590 affects the Ivan Cordoba Generic Content Management System (CMS) up to 2018-04-28. The vulnerability is a Cross-Site Scripting (XSS) flaw in the file or path used by the Administrator/users.php user ID. The linked CNVD entry describes that the XSS can allow execution of arbitrary J...