razorCMS Cross-Site Request Forgery Vulnerability (CNVD-2018-26701)

razorCMS is an open source content management system written in PHP, which stores all data in flat files, so there is no need to install a database. A cross-site request forgery vulnerability exists in the rars/user/data page in razorCMS version 3.4.8. A remote attacker can exploit this...

CVE-2018-19544

JEECMS 9.3 has CSRF via the api/admin/content/save URI to add news...

JEECMS Cross-Site Request Forgery Vulnerability (CNVD-2018-26785)

JEECMS is a set of China Jinlei technology development company using Java language development of content management system CMS. A cross-site request forgery vulnerability exists in JEECMS version 9.3. A remote attacker can exploit this vulnerability to add news with the help of...

arcms unauthorized access vulnerability

arcms is a content management system based on layui and arphp. A security vulnerability exists in arcms 2018-03-19 and earlier versions, which stems from the program failing to authenticate index/main, user/useradd, or img/images. An attacker can exploit the vulnerability to gain unauthorized...

SDCMS Arbitrary Code Execution Vulnerability

SDCMS is a PHP and MySQL based enterprise station building content management system CMS from China Fireworks Network Technology Company. A security vulnerability exists in SDCMS version 1.6, which uses PHP version 5.x. The vulnerability can be exploited to execute arbitrary code by accessing the...

CVE-2018-19437

UCMS 1.4.7 allows remote authenticated users to change the administrator password because $COOKIE'admin'.cookiehash is used for arbitrary cookie values that are set and not empty...

UCMS Administrator Password Change Vulnerability

UCMS is a content management system written in PHP. A security vulnerability exists in UCMS version 1.4.7, where the vulnerable program uses COOKIE'admin'.cookiehash for arbitrary cookie values. A remote attacker can exploit the vulnerability to change the administrator password...

S-CMS SQL Injection Vulnerability (NVD-C-2018-125521)

S-CMS is Zibo Shining Network Technology Co., Ltd. developed a specialized enterprise to provide solutions to build a station of the product. The search.php in S-CMS 1.5 has a SQL injection vulnerability, which can be exploited by an attacker through the keyword parameter to perform a SQL injecti...

JTBC(PHP) Cross-Site Request Forgery Vulnerability

JTBC PHP is an open source CMS Content Management System. JTBCPHP 3.0.1.7 version of aboutus/manage.php?type=action&action=add cross-site request forgery vulnerability, remote attackers can use the vulnerability to perform unauthorized operations...

XiaoCms File Upload Vulnerability

XiaoCms is a lightweight content management system CMS based on PHP and MySQL and capable of running on Linux, Windows and other platforms. A security vulnerability exists in the admin\controller\uploadfile.php file in XiaoCms version 20141229. A remote attacker can exploit the vulnerability by...

SQL Injection Vulnerability in MetInfo Version 6.1.3

MetInfo is a content management system developed using PHP and Mysql. A SQL injection vulnerability exists in MetInfo version 6.1.3. An attacker can exploit the vulnerability to obtain sensitive database information...

LAOBANCMS SQL Injection Vulnerability

Laoban CMS LAOBANCMS content management system is based on PHP + MYSQL environment developed by the old class of open-source website building system . LAOBANCMS 2.0 has a SQL injection vulnerability. Attackers can exploit this vulnerability through the admin/login.php guanliyuan parameter for SQL...

File upload vulnerability in YCCMS v3.3 system (CNVD-2018-24653)

YCCMS is a version of PHP5 + MYSQL as the technical basis for the development of lightweight CMS station-building system. YCCMS v3.3 system has a file upload vulnerability that can be exploited by attackers to upload arbitrary files and gain control of the web server...

Arbitrary Password Reset Vulnerability in EBCMS (Newsfeed Edition)

EBCMS is a modular plug-in website management system based on PHP+Mysql. EBCMS News and Information Version has an arbitrary password reset vulnerability that can be exploited by an attacker to change any user's password...

SQL Injection Vulnerability in HDCMS v2.0 groupLists Function

HDCMS is a content management system software package developed in PHP+Mysql. It provides customers with powerful and complete functionality to accomplish rapid website development. HDCMS v2.0 version groupLists function has a SQL injection vulnerability, remote attackers can use this vulnerabili...

Arbitrary File Write Vulnerability in LaySNS v2.4

LaySNS is a lightweight, ThinkPHP+Layui-based integrated website management system that integrates content management and community interaction. LaySNS v2.4 has an arbitrary file write vulnerability that can be exploited by an attacker to write arbitrary files and gain control of the web server...

MetInfo Cross-Site Scripting Vulnerability (CNVD-2019-09129)

MetInfo is a Content Management System CMS developed using PHP and Mysql. MetInfo 6.1.3 suffers from a cross-site scripting vulnerability that can be exploited by an attacker via the admin/index.php?a=dogetpassword langset parameter to conduct a cross-site scripting attack...

PHP7CMS frontend Se***.php file has SQL injection vulnerability

PHP7 content management system referred to as PHP7CMS by Chunjie studio using PHP7 technology newly developed content management program. PHP7CMS foreground Se.php file exists SQL injection vulnerability. Attackers can use the vulnerability to obtain sensitive database information...

Code Execution Vulnerability in PHP7CMS

PHP7 content management system referred to as PHP7CMS by Chunjie studio using PHP7 technology newly developed content management program. A code execution vulnerability exists in PHP7CMS. The vulnerability is due to Modulecreate.php lack of filtering of $data'icon', an attacker can take advantage...

PHP7CMS frontend has a file inclusion vulnerability

PHP7 content management system referred to as PHP7CMS by Chunjie studio using PHP7 technology newly developed content management program. PHP7CMS front-end file inclusion vulnerability. Attackers can use the vulnerability to include log files to write a sentence Trojan to obtain server privileges...