CMS Made Simple 2.2.7 Remote Code Execution Exploit

Exploit for php platform in category web applications Exploit Title: CMS Made Simple 2.2.7 - Remote Code Execution Exploit Author: Lucian Ioan Nitescu Contact: https://twitter.com/LucianNitescu Webiste: https://nitesculucian.github.io Vendor Homepage: https://www.cmsmadesimple.org/ Software Link:...

CMS Made Simple 2.2.7 Remote Code Execution

Exploit Title: CMS Made Simple 2.2.7 - Remote Code Execution Date: 04-11-2018 Exploit Author: Lucian Ioan Nitescu Contact: https://twitter.com/LucianNitescu Webiste: https://nitesculucian.github.io Vendor Homepage: https://www.cmsmadesimple.org/ Software Link:...

CVE-2018-18831

An issue was discovered in com\mingsoft\cms\action\GeneraterAction.java in MCMS 4.6.5. An attacker can write a .jsp file in the position parameter to an arbitrary directory via a ../ Directory Traversal in the url parameter...

zzcms SQL Injection Vulnerability (CNVD-2018-26013)

ZZCMS is a CMS Content Management System used to quickly build Merchants type websites. A SQL injection vulnerability exists in the ajax/zs.php file in ZZCMS version 8.3. A remote attacker can exploit this vulnerability to obtain the current user name of mysql with the help of pxzs cookie...

Code Execution Vulnerability in X6CMS_V2.2

X6CMS, the full name of Xiaoliu Website Content Management System. X6CMS is a marketing website management platform with PHP+MYSQL architecture. A code execution vulnerability exists in X6CMSV2.2. An attacker can write any php code to gain server privileges...

CVE-2018-18420

Cross-Site Request Forgery CSRF vulnerability was discovered in the 8.3 version of Zenario Content Management System via the admin/organizer.ajax.php?path=zenariocontent%2Fpanels%2Fcontent URI...

CVE-2018-18420

Cross-Site Request Forgery CSRF vulnerability was discovered in the 8.3 version of Zenario Content Management System via the admin/organizer.ajax.php?path=zenariocontent%2Fpanels%2Fcontent URI...

PbootCMS SQL Injection Vulnerability (CNVD-2018-21503)

PbootCMS is an open source enterprise building content management system CMS developed using the PHP language. A SQL injection vulnerability exists in the apps\admin\controller\content\SingleController.php file in PbootCMS version 1.2.2-20181012. A remote attacker can exploit this vulnerability t...

LUYA CMS Cross-Site Scripting Vulnerability

LUYA CMS is a scalable content management system CMS. A cross-site scripting vulnerability exists in LUYA CMS version 1.0.12. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML via /admin/api-cms-nav/create-page...

nc-cms cross-site scripting vulnerability

nc-cms is a PHP-based embeddable lightweight CMS content management system. A cross-site scripting vulnerability exists in the index.php?action=edithtml&name=homecontent URI in nc-cms 2017-03-10 and earlier versions, which can be exploited by remote attackers to inject malicious JavaScript code...

CMS Made Simple Cross-Site Scripting Vulnerability (CNVD-2018-21252)

CMS Made Simple CMSMS is an open source content management system CMS developed by the CMSMS team. The system supports role-based rights management system , wizard-based installation and update mechanism , intelligent caching mechanism and so on. A cross-site scripting vulnerability exists in the...

JTBC (PHP) File Deletion Vulnerability

JTBC PHP is an open source CMS Content Management System. JTBC PHP 3.0.1.6 version of the file deletion vulnerability , a remote attacker can use /console/file/manage.php?type=action&action=delete&path=c%3A%2F URL to exploit the vulnerability to delete arbitrary files on the system...

NUUO CMS Elevation of Privilege Vulnerability

NUUO CMS is a set of centralized software management platform from NUUO. The platform is used to centrally manage devices such as NVRs hard disk recorders and IP cameras, and provides functions such as user management and alarm management. A security vulnerability exists in NUUO CMS 3.1 and earli...

CVE-2018-17890

NUUO CMS all versions 3.1 and prior, The application uses insecure and outdated software components for functionality, which could allow arbitrary code execution...

CVE-2018-17894

NUUO CMS all versions 3.1 and prior, The application creates default accounts that have hard-coded passwords, which could allow an attacker to gain privileged access...

qibosoft Cross-Site Request Forgery Vulnerability

qibosoft is a content management system of China Qibo Software qibosoft Company. A cross-site request forgery vulnerability exists in qibosoft version 7.0. A remote attacker can add a user account using admin/index.php?lfj=member&action=addmember to exploit this vulnerability...

Code Execution Vulnerability in YIXUNCMS 2.0.4.91SD

YIXUNCMS is a showcase website system developed by Yixun Software Studio for small and medium-sized enterprises, using PHP language and with a stable MYSQL database. YIXUNCM2.0.4.91SD version of the management background of the code execution vulnerabilities, the vulnerability stems from the syst...

e107 Cross-Site Request Forgery Vulnerability (CNVD-2018-20077)

e107 is an open source, free and PHP and MySQL based Content Management System CMS developed by the e107 team. The system supports a variety of plug-ins and appearance of the theme , can be used as a personal blog , discussion community , archive repository and so on. A cross-site request forgery...

OTCMS Arbitrary PHP Code Execution Vulnerability

OTCMS is an article-based web content management system CMS. A security vulnerability exists in OTCMS version 3.61. The vulnerability can be exploited by remote attackers to execute arbitrary PHP code with the help of 'accBackupDir' parameter...

SQL Injection Vulnerability in MetInfo

MetInfo is a content management system developed using PHP and Mysql. MetInfo suffers from a SQL injection vulnerability. An attacker can exploit the vulnerability to obtain sensitive database information...