PHPCMS V9.6 WAP Module Arbitrary File Upload Vulnerability

PHPCMS is a web content management system based on PHP and Mysql architecture. The system includes modules such as news, pictures, downloads, information and products. PHPCMS V9.6 WAP module is not strict in filtering file extensions uploaded by front-end users, resulting in an arbitrary file...

Xionghai CMS v1.0 Backend Login Bypass Vulnerability

XIONGHAI CMS is developed by XIONGHAI a set of applications for personal blogs, personal websites, corporate websites, a set of integrated website management system. XIONGHAI CMS v1.0 there is a backend privilege bypass vulnerability, attackers can forge COOKIE bypass login detection, successfull...

Stored Cross-Site Scripting Vulnerability in PageAdmin CMS Online Message Feature

PageAdmin CMS is an enterprise building system based on PHP and mysql technology. A stored cross-site scripting vulnerability exists in the online message function of PageAdmin CMS. An attacker can insert malicious js code into the page to obtain user cookies and other information, resulting in...

Backdoor Vulnerability in S-CMS

S-CMS is a corporate website building system developed by Zibo Shining Network Technology Co. S-CMS there is a backdoor vulnerability, the reason for this vulnerability is /conn/function.asp file encrypted sentence can be deformed into a Trojan horse caused by the password is the 32-bit md5 value...

Pixie 1.0.4 - Arbitrary File Upload

Exploit Title: File Extension Filter Bypass in File Manager Pixie 1.0.4 With Low Privilege Google Dork: no Date: 02-April-2017 Exploit Author: @runggareksya, @dvnrcy, @dickysofficial Vendor Homepage: http://www.getpixie.co.uk Software Link:...

Pixie 1.0.4 Shell Upload

Exploit Title: File Extension Filter Bypass in File Manager Pixie 1.0.4 With Low Privilege Google Dork: no Date: 02-April-2017 Exploit Author: @runggareksya, @dvnrcy, @dickysofficial Vendor Homepage: http://www.getpixie.co.uk Software Link:...

Pixie 1.0.4 Cross Site Scripting

Exploit Title: XSS Vulnerability on Pixie 1.0.4 Google Dork: no Date: 29-03-2017 Exploit Author: @runggareksya, @dickysofficial Vendor Homepage: http://www.getpixie.co.uk Software Link:...

CMS Made Simple Cross-Site Scripting Vulnerability (CNVD-2017-04704)

CMS Made Simple CMSMS is an open source content management system CMS developed by the CMSMS team. The system supports role-based rights management system , wizard-based installation and update mechanism , intelligent caching mechanism and so on. A cross-site scripting vulnerability exists in the...

Nuxeo 6.0 / 7.1 / 7.2 / 7.3 - Remote Code Execution Exploit

Exploit for jsp platform in category web applications =begin Description Nuxeo Platform is a content management system for enterprises CMS. It embeds an Apache Tomcat server, and can be managed through a web interface. One of its features allows authenticated users to import files to the platform...

CMS Made Simple Cross-Site Scripting Vulnerability (CNVD-2017-04705)

CMS Made Simple CMSMS is an open source content management system CMS developed by the CMSMS team. The system supports role-based rights management system , wizard-based installation and update mechanism , intelligent caching mechanism and so on. A cross-site scripting vulnerability exists in the...

Nuxeo 6.07.17.27.3 - Remote Code Execution (Metasploit)

Nuxeo 6.07.17.27.3 - Remote Code Execution Metasploit =begin Description Nuxeo Platform is a content management system for enterprises CMS. It embeds an Apache Tomcat server, and can be managed through a web interface. One of its features allows authenticated users to import files to the platform...

CVE-2017-7255

XSS exists in the CMS Made Simple CMSMS 2.1.6 "Content--News--Add Article" feature via the m1title parameter. Someone must login to conduct the attack...

Cross site scripting

XSS exists in the CMS Made Simple CMSMS 2.1.6 "Content--News--Add Article" feature via the m1summary parameter. Someone must login to conduct the attack...

Cross site scripting

XSS exists in the CMS Made Simple CMSMS 2.1.6 "Content--News--Add Article" feature via the m1title parameter. Someone must login to conduct the attack...

CVE-2017-7255

CVE-2017-7255 describes a cross-site scripting (XSS) vulnerability in CMS Made Simple (CMSMS) 2.1.6, triggered in the Content→News→Add Article workflow via the m1_title parameter. Affected software is CMSMS; the issue is a reflected/stored XSS caused by unsanitized input in the m1_title field, wi...

CVE-2017-7257

CVE-2017-7257 describes a cross-site scripting (XSS) vulnerability in CMS Made Simple (CMSMS) 2.1.6, specifically in the Content→News→Add Article feature via the m1_content parameter. The description notes that an attacker must be logged in to perform the attack, and the vulnerability affects the...

CVE-2017-7257

XSS exists in the CMS Made Simple CMSMS 2.1.6 "Content--News--Add Article" feature via the m1content parameter. Someone must login to conduct the attack...

CVE-2017-7256

XSS exists in the CMS Made Simple CMSMS 2.1.6 "Content--News--Add Article" feature via the m1summary parameter. Someone must login to conduct the attack...

PT-2017-17615 · Cmsms · Cms Made Simple

Name of the Vulnerable Software and Affected Versions: CMS Made Simple CMSMS version 2.1.6 Description: A security issue exists in the "Content--News--Add Article" feature of the software, where an attacker can exploit the m1 summary parameter to conduct a cross-site scripting XSS attack. This...

SQL Injection Vulnerability in Webkravat Content Management System ic.php Page

Webkrava is a small cms system by php+mysql. A SQL injection vulnerability exists in the ic.php page of the Webkravat content management system. The lack of filtering of the 'id' parameter allows an attacker to exploit the vulnerability to obtain sensitive information about the database...