4391 matches found
Cross Site Request Forgery in SwiftyEdit
SwiftyEdit Content Management System prior to v1.2.0 is vulnerable to Cross Site Request Forgery CSRF...
CVE-2023-47350
Cross-Site Request Forgery CSRF vulnerability in SwiftyEdit Content Management System prior to v1.2.0, allows remote attackers to escalate privileges via the user password update functionality...
CVE-2023-47350
Cross-Site Request Forgery CSRF vulnerability in SwiftyEdit Content Management System prior to v1.2.0, allows remote attackers to escalate privileges via the user password update functionality...
CVE-2023-48701
Statamic CMS (Laravel/Git) suffers a Cross-site Scripting (XSS) via uploaded assets vulnerability (CVE-2023-48701). Before versions 3.4.15 and 4.36.0, HTML files crafted to look like images could be uploaded regardless of MIME validation via front-end Forms assets fields or the authenticated cont...
FreeBSD : typo3 -- Multiple vulnerabilities (7cc003cb-83b9-11ee-957d-b42e991fc52e)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 7cc003cb-83b9-11ee-957d-b42e991fc52e advisory. - TYPO3 is an open source PHP based web content management system released under the GNU GPL. ...
CVE-2023-47127
TYPO3 is an open source PHP based web content management system released under the GNU GPL. In typo3 installations there are always at least two different sites. Eg. first.example.org and second.example.com. In affected versions a session cookie generated for the first site can be reused on the...
CVE-2023-47125 By-passing Cross-Site Scripting Protection in HTML Sanitizer
TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions DOM processing instructions are not handled correctly. This allows bypassing the cross-site scripting mechanism of typo3/html-sanitizer. This vulnerability has been addressed in versio...
CVE-2023-47126
TYPO3 information-disclosure CVE-2023-47126: In affected TYPO3 versions, the login screen of the standalone install tool reveals the full path to the transient data directory (e.g., /var/www/html/var/transient/) for composer-based installations; classic non-composer installations are not affected...
CVE-2023-47126 Information Disclosure in Install Tool in typo3/cms-install
TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions the login screen of the standalone install tool discloses the full path of the transient data directory e.g. /var/www/html/var/transient/. This applies to composer-based scenarios only...
CVE-2023-47127
TYPO3 core vulnerability CVE-2023-47127: in installations with multiple sites, a session cookie from one site can be reused on another without re-authentication. Affects TYPO3 CMS core; remediation is to upgrade to fixed versions (8.7.55, 9.5.44, 10.4.41, 11.5.33, 12.4.8). The connected advisorie...
Code injection
Statmic is a core Laravel content management system Composer package. Prior to versions 3.4.13 and 4.33.0, on front-end forms with an asset upload field, PHP files crafted to look like images may be uploaded. This only affects forms using the "Forms" feature and not just any arbitrary form. This...
Fedora: Security Advisory (FEDORA-2023-b659c62db9)
The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
[SECURITY] Fedora 39 Update: drupal7-7.98-1.fc39
Equipped with a powerful blend of features, Drupal is a Content Management System written in PHP that can support a variety of websites ranging from personal weblogs to large community-driven websites. Drupal is highly configurable, skinnable, and secure...
PT-2023-32418 · Sourcecodester · Sourcecodester Company Website Cms
Name of the Vulnerable Software and Affected Versions: SourceCodester Company Website CMS version 1.0 Description: A vulnerability was found in the Create Blog Page component, specifically affecting some unknown functionality of the file /dashboard/createblog. This issue leads to unrestricted...
BaserCMS Cross-Site Request Forgery Vulnerability (CNVD-2023-86125)
baserCMS is an enterprise-level content management system CMS from the baserCMS team. A cross-site request forgery vulnerability exists in baserCMS versions prior to 4.8.0, which stems from the content preview feature not adequately verifying whether a request comes from a trusted user. This...
CVE-2023-46040
Cross Site Scripting vulnerability in GetSimpleCMS v.3.4.0a allows a remote attacker to execute arbitrary code via the a crafted payload to the components.php function...
CVE-2023-43352
An issue in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted payload to the Content Manager Menu component...
PortlandLabs Concrete CMS Cross-Site Scripting Vulnerability
PortlandLabs Concrete CMS is a team-oriented open source content management system of the United States PortlandLabs company . A cross-site scripting vulnerability exists in PortlandLabs Concrete CMS v.9.2.1, which stems from the lack of effective filtering and escaping of user-supplied data by t...
zzzCMS Code Issues Vulnerabilities
ZZZCMS is a content management system CMS. A security vulnerability exists in zzzCMS version v.2.1.9, which originates from a vulnerability that allows remote attackers to execute arbitrary code via the downurl function in the zzzz.php file...