PT-2017-11761 · Bolt · Bolt Cms

Name of the Vulnerable Software and Affected Versions: Bolt CMS version 3.2.14 Description: The issue allows stored XSS via text input, as demonstrated by the Title field of a New Entry. This can be exploited by injecting malicious code into the text input fields. Recommendations: For Bolt CMS...

MetInfo Code Execution Vulnerability

MetInfo is a Content Management System CMS developed using PHP and Mysql. An arbitrary code execution vulnerability exists in MetInfo version 5.3.17. A remote attacker can exploit this vulnerability to create PHP scripts with malicious images...

FineCMS Arbitrary Code Execution Vulnerability

FineCMS is a content management system CMS developed using MVC architecture and PDO database interface. An arbitrary code execution vulnerability exists in FineCMS version 2.1.0. A remote attacker can exploit this vulnerability to execute arbitrary PHP code...

Arbitrary Code Execution Vulnerability in S-CMS class.asp

S-CMS is a corporate website building system developed by Zibo Shining Network Technology Co. S-CMS class.asp has an arbitrary code execution vulnerability that can be exploited by attackers to execute arbitrary code...

[SECURITY] Fedora 26 Update: drupal7-7.56-1.fc26

Equipped with a powerful blend of features, Drupal is a Content Management System written in PHP that can support a variety of websites ranging from personal weblogs to large community-driven websites. Drupal is highly configurable, skinnable, and secure...

e107 v2 Bootstrap CMS - CSRF Web Vulnerability

Document Title: =============== e107 v2 Bootstrap CMS - CSRF Web Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2083 Release Date: ============= 2017-07-06 Vulnerability Laboratory ID VL-ID: ==================================== 2083 Commo...

e107 v2 Bootstrap CMS - CSRF Web Vulnerability

Document Title: =============== e107 v2 Bootstrap CMS - CSRF Web Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2083 Release Date: ============= 2017-07-05 Vulnerability Laboratory ID VL-ID: ==================================== 2083 Commo...

[SECURITY] Fedora 25 Update: drupal7-7.56-1.fc25

Equipped with a powerful blend of features, Drupal is a Content Management System written in PHP that can support a variety of websites ranging from personal weblogs to large community-driven websites. Drupal is highly configurable, skinnable, and secure...

CVE-2016-6201

CVE-2016-6201 affects Ektron Content Management System (CMS) before 9.1.0.184 SP3. The flaw allows remote attackers to inject arbitrary web script/HTML via the ContType parameter in ViewContentByCategory under WorkArea/content.aspx, i.e., a cross-site scripting (XSS) vector. The vulnerability is ...

CVE-2016-6201

Cross-site scripting XSS vulnerability in Ektron Content Management System CMS before 9.1.0.184 SP3 9.1.0.184.3.127 allows remote attackers to inject arbitrary web script or HTML via the ContType parameter in a ViewContentByCategory action to WorkArea/content.aspx...

Reflective Cross-site Scripting Vulnerability in Five Fingers CMS System

Five Fingers CMS is an open source content management system suitable for portals, corporate website builders, mobile websites and microblogging promotion. Five Fingers CMS system version v4.0.0 reflective cross-site scripting vulnerability, attackers by inserting XSS malicious code to perform...

Arbitrary File Download Vulnerability in Generalized cms of Office System of Higher Education Worker Network

Higher Education Academic Network Office System General CMS is a college office system. There is an arbitrary file download vulnerability in the generic cms. The vulnerability stems from the downloadfile.aspx program downurl parameter can be controlled due to the attacker can take advantage of th...

WonderCMS 2.1.0 - Cross-Site Request Forgery Vulnerability

Exploit for php platform in category web applications document.forms0.submit; !-- Disclosure Timeline: --------------------- 2017-06-16: Vulnerability found. 2017-06-17: Reported to vendor. 2017-06-17: Vendor responded and send a new version for test in it. 2017-06-17: Test new version and...

simpleCE Cross-Site Scripting Vulnerability

simpleCE is a simple content management system with a front-end editor mode . A cross-site scripting vulnerability exists in simpleCE in index.php/content/text/1?returnurl=XSS, which allows an attacker to exploit the vulnerability to gain normal user or administrator privileges...

WonderCMS 2.1.0 - Cross-Site Request Forgery

document.forms0.submit; !-- Disclosure Timeline: --------------------- 2017-06-16: Vulnerability found. 2017-06-17: Reported to vendor. 2017-06-17: Vendor responded and send a new version for test in it. 2017-06-17: Test new version and vulernability patched successfully. 2017-06-18: Vendor...

CVE-2017-9668

In admin\addgroup.php in CMS Made Simple 2.1.6, when adding a user group, there is no XSS filtering, resulting in storage-type XSS generation, via the description parameter in an addgroup action...

SimpleCE 2.3.0 Cross Site Request Forgery / Cross Site Scripting

Exploit Title: SimpleCE 2.3.0 - Multiple Vulnerabilities XSS CSRF Date: 2017-06-14 Exploit Author: 8bitsec Vendor Homepage: http://simplece.com Software Link: https://codecanyon.net/item/simplece-v2-mini-cms/9140868 Version: 2.3.0, probably older versions Tested on: Kali Linux 2.0 | Mac OS 10.12....

Craft CMS 2.6 - Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: Craft CMS 2.6 - Cross-Site Scripting/Unrestricted File Upload Date: 2017-06-08 Exploit Author: Ahsan Tahir Vendor Homepage: https://craftcms.com Software Link: http://download.craftcdn.com/craft/2.6/2.6.2981/Craft-2.6.2981.zip...

Composr CMS v10.0.0 - Cross Site Scripting Vulnerability

Document Title: =============== Composr CMS v10.0.0 - Cross Site Scripting Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2066 Release Date: ============= 2017-06-08 Vulnerability Laboratory ID VL-ID: ====================================...

Craft CMS 2.6 - Cross-Site Scripting

Craft CMS 2.6 - Cross-Site Scripting Exploit Title: Craft CMS 2.6 - Cross-Site Scripting/Unrestricted File Upload Date: 2017-06-08 Exploit Author: Ahsan Tahir Vendor Homepage: https://craftcms.com Software Link: http://download.craftcdn.com/craft/2.6/2.6.2981/Craft-2.6.2981.zip Version: 2.6 Teste...