MRCMS 安全漏洞

MRCMS is a content management system by marker personal developer. A security vulnerability exists in MRCMS version v3.1.2, which stems from the /controller/UserController.java module containing an elevation of privilege vulnerability...

Access Control Bypass

Overview Affected versions of this package are vulnerable to Access Control Bypass due to improper access control mechanisms. An attacker can bypass security restrictions by exploiting the vulnerability in the management system. Remediation Upgrade opensource-workshop/connect-cms to version 1.8.7...

The vulnerability of the CMSimple content management system’s link validation function allows attackers to perform SSRF attacks.

The vulnerability of the CMSimple content management system’s link validation function is related to insufficient protection of operational data. Exploiting this vulnerability could allow a malicious actor to carry out an SSRF attack remotely...

CVE-2024-41802

Xibo is a content management system CMS. An SQL injection vulnerability was discovered in the API routes inside the CMS responsible for Filtering DataSets. This allows an authenticated user to to obtain and modify arbitrary data from the Xibo database by injecting specially crafted values in to t...

CVE-2024-10758

A vulnerability, which was classified as critical, was found in code-projects/anirbandutta9 Content Management System and News-Buzz 1.0. This affects an unknown part of the file /index.php. The manipulation of the argument username leads to sql injection. It is possible to initiate the attack...

CVE-2024-28117

Grav is an open-source, flat-file content management system. Prior to version 1.7.45, Grav validates accessible functions through the Utils::isDangerousFunction function, but does not impose restrictions on twig functions like twigarraymap, allowing attackers to bypass the validation and execute...

The vulnerability of the /admin/tag/save file in the Jfinal CMS system allows a attacker to perform a CSRF attack.

The vulnerability of the /admin/tag/save file in the Jfinal CMS system is related to the manipulation of cross-site requests. Exploiting this vulnerability allows a malicious actor to perform a CSRF attack remotely...

ChestnutCMS 安全漏洞

ChestnutCMS is a front-end and back-end separated enterprise-level content management system by liweiyi individual developer. A security vulnerability exists in ChestnutCMS version 1.5.0 and prior versions, which stems from the vulnerability of uploading files via the Create Template feature...

ZZCMS 安全漏洞

ZZCMS is a content management system CMS from the ZZCMS team in China. A security vulnerability exists in ZZCMS version 2023 and earlier versions. The vulnerability stems from the front-end website not being effectively protected against SQL injection, which allows attackers to gain unauthorized...

The vulnerability of the Open Social CMS system’s Drupal module, related to access control deficiencies, allows attackers to bypass security restrictions.

The vulnerability of the Open Social CMS system, Drupal, is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to bypass security restrictions remotely...

CVE-2025-24012 Umbraco Backoffice Components Have XSS/HTML Injection Vulnerability

Umbraco is a free and open source .NET content management system. Starting in version 14.0.0 and prior to versions 14.3.2 and 15.1.2, authenticated users are able to exploit a cross-site scripting vulnerability when viewing certain localized backoffice components. Versions 14.3.2 and 15.1.2 conta...

CVE-2025-24012

Umbraco Backoffice XSS (CVE-2025-24012): An authenticated user can trigger cross-site scripting when viewing certain localized backoffice components. Affected versions are 14.0.0 up to, but not including, 14.3.2 and 15.1.2. Patches are provided in 14.3.2 and 15.1.2. Remediation: upgrade Umbraco.C...

PT-2025-3422 · Otcms · Otcms

Name of the Vulnerable Software and Affected Versions: OtCMS versions =7.46 Description: The issue allows for Server-Side Request Forgery SSRF in the "/admin/read.php" API endpoint, enabling arbitrary system file reads. Recommendations: For OtCMS versions =7.46, as a temporary workaround, conside...

The vulnerability of the Drupal CMS system’s RESTful Web Services module, related to errors in request processing, allows attackers to gain unauthorized access to protected information.

The vulnerability of the Drupal CMS system’s RESTful Web Services module is related to errors in request processing. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

07FLYCMS 安全漏洞

07FLYCMS is a free and open source content management system from China Zero Takeoff 07FLY. A security vulnerability exists in 07FLYCMS version V1.3.9, which stems from vulnerability to cross-site request forgery attacks...

CVE-2025-0486

A vulnerability was found in Fanli2012 native-php-cms 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /fladmin/login.php. The manipulation of the argument username leads to sql injection. The attack can be launched remotely. The exploi...

PT-2025-4752 · Ddsn Interactive · Ddsn Interactive Cm3 Acora Cms

Name of the Vulnerable Software and Affected Versions: DDSN Interactive cm3 Acora CMS version 10.1.1 Description: The issue is caused by insufficient input sanitization and validation in the table parameter, leading to an unauthenticated time-based blind SQL Injection. This allows attackers to...

Cross-site Scripting (XSS)

Overview silverstripe/framework is a PHP framework forming the base for the SilverStripe CMS. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the insert media functionality where the linked oEmbed JSON includes an HTML attribute which replaces the embed shortcode...

CVE-2025-0346

A vulnerability was found in code-projects Content Management System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/publishnews.php of the component Publish News Page. The manipulation of the argument image leads to unrestricted upload. It is possible to...

CVE-2025-0346

A vulnerability was found in code-projects Content Management System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/publishnews.php of the component Publish News Page. The manipulation of the argument image leads to unrestricted upload. It is possible to...