UNL-CMS Cross-Site Request Forgery Vulnerability (CNVD-2018-19097)

UNL-CMS is a PHP-based content management system. A cross-site request forgery vulnerability exists in UNL-CMS version 7.59, which can be exploited by remote attackers to update the settings of a website with the help of the...

LG SuperSign CMS Authentication Bypass Vulnerability

LG SuperSign CMS is a content management system for LG webOS from the Luckin LG Group in Korea. The system supports connection to external databases and allows access to the server from mobile devices. An authentication bypass vulnerability exists in LG SuperSign CMS, which can be exploited by an...

ZZCMS 8.3 version zs***.php file has SQL injection vulnerability

ZZCMS is a CMS Content Management System used to quickly build Merchants type websites. A SQL injection vulnerability exists in the zs.php file of ZZCMS version 8.3. An attacker can exploit the vulnerability to obtain sensitive information from the database...

SQL injection vulnerability in ZZCMS version 8.3 zs***.php file (CNVD-2018-19951)

ZZCMS is a CMS Content Management System used to quickly build Merchants type websites. A SQL injection vulnerability exists in the zs.php file of ZZCMS version 8.3. An attacker can exploit the vulnerability to obtain sensitive information from the database...

OTCMS cross-site scripting vulnerability (CNVD-2018-19093)

OTCMS is an article-based web content management system CMS. A cross-site scripting vulnerability exists in the admin/users.php file in OTCMS version 3.61, which can be exploited by remote attackers to inject arbitrary web script or HTML with the help of the 'dataTypeCN', 'dataMode' and...

QuickAppsCMS Cross-Site Request Forgery Vulnerability (CNVD-2018-19557)

QuickAppsCMS aka QACMS is an open source content management system CMS developed using the MVC framework. A cross-site request forgery vulnerability exists in QuickAppsCMS 2.0.0-beta2 and earlier versions. A remote attacker can exploit this vulnerability to change the administrator password with...

File Upload Vulnerability in YCCMS v3.3

YCCMS is a PHP version of a lightweight CMS builder. A file upload vulnerability exists in YCCMS v3.3. It allows attackers to upload webshell and gain server privileges...

CScms Arbitrary Directory Deletion Vulnerability

CScms is a content management system CMS developed on a CI framework. An arbitrary directory deletion vulnerability exists in CScms version 4.1. An attacker can delete arbitrary directories by sending a dir=... to the plugins\sys\admin\Plugins.php page. \\ sub-string to the...

CVE-2018-17037

user/editpost.php in UCMS 1.4.6 mishandles levels, which allows escalation from the normal user level of 1 to the superuser level of 3...

e107 SQL Injection Vulnerability (CNVD-2018-18891)

e107 is an open source, free and PHP and MySQL based Content Management System CMS developed by the e107 team. The system supports a variety of plug-ins and appearance of the theme , can be used as a personal blog , discussion community , archive repository and so on. A SQL injection vulnerabilit...

HongCMS Arbitrary File Deletion Vulnerability

HongCMS is an open source lightweight content management system CMS. HongCMS suffers from an arbitrary file deletion vulnerability. An attacker can exploit this vulnerability to delete arbitrary files...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect Enterprise Content Management System Monitor

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 7 used by Enterprise Content Management System Monitor. These issues were disclosed as part of the IBM® SDK Java™ Technology Edition Quarterly CPU - Jan 2018 - Includes Oracle Jan 2018 CPU. Vulnerability...

File Upload Vulnerability in POSCMS

POSCMS is an open source cross-platform web content management system developed by Php+Mysql. POSCMS v3.2.0 free version has a file upload vulnerability that can be exploited by an attacker to upload files with unlimited Getshell...

HDCMS v2.0 suffers from SQL injection vulnerability (CNVD-2018-19306)

HDCMS is a content management system software package developed in PHP+Mysql. It provides customers with powerful and complete functionality to accomplish rapid website development. HDCMS v2.0 version has a SQL injection vulnerability, which can be exploited by remote attackers to obtain sensitiv...

idreamsoft iCMS Cross-Site Request Forgery Vulnerability (CNVD-2019-10137)

idreamsoft iCMS is an open source content management system CMS based on PHP and MySQL. A cross-site request forgery vulnerability exists in admincp.php?app=group&do=save in idreamsoft iCMS 7.0.10, which can be exploited by an attacker to add an administrator account...

Frog CMS File Upload Vulnerability (CNVD-2019-10141)

Frog CMS is a content management system CMS developed by software developer Philippe Archambault. The system provides tools for page templates, user rights management, and document management. A file upload vulnerability exists in Frog CMS 0.9.5, which can be exploited by an attacker via /admin/?...

CVE-2018-16320

idreamsoft iCMS 7.0.11 allows admincp.php?app=config Directory Traversal, resulting in execution of arbitrary PHP code from a ZIP file...

JVN#89550319: Movable Type vulnerable to cross-site scripting

Movable Type provided by Six Apart, Ltd. is a content management system. Movable Type contains a cross-site scripting vulnerability CWE-79. Impact An arbitrary script may be executed on the user's web browser. Solution Update the Software Update to the latest version according to the information...

PHP7CMS has a file upload vulnerability

PHP7 content management system referred to as PHP7CMS by Chunjie studio using PHP7 technology newly developed content management program. PHP7CMS has a file upload vulnerability. Allows attackers to upload webshell and gain server privileges...

Cagintranet Networks GetSimple CMS Cross-Site Scripting Vulnerability (CNVD-2018-16498)

Cagintranet Networks GetSimple CMS is an XML-based content management system CMS from Cagintranet Networks, USA. The system includes a theme selector and editor, component editor, image and file managers, and more. A cross-site scripting vulnerability exists in the admin/edit.php file in...