4391 matches found
Design/Logic Flaw
Strapi is an open-source headless content management system. Prior to version 4.11.7, an unauthorized actor can get access to user reset password tokens if they have the configure view permissions. The /content-manager/relations route does not remove private fields or ensure that they can't be...
CVE-2023-37263
CVE-2023-37263 affects Strapi (open-source headless CMS). The issue: field-level permissions are not respected in the relationship title, causing a field the user should not see to be visible when a relation includes that field. Impact is described as information disclosure under older releases. ...
CVE-2023-37263 Strapi's field level permissions not being respected in relationship title
Strapi is the an open-source headless content management system. Prior to version 4.12.1, field level permissions are not respected in the relationship title. If an actor has relationship title and the relationship shows a field they don't have permission to see, the field will still be visible...
CVE-2023-36472 Strapi may leak sensitive user information, user reset password, tokens via content-manager views
Strapi is an open-source headless content management system. Prior to version 4.11.7, an unauthorized actor can get access to user reset password tokens if they have the configure view permissions. The /content-manager/relations route does not remove private fields or ensure that they can't be...
CSZCMS Cross-Site Scripting Vulnerability
CSZCMS is an open source web application that allows managing all content and settings on a website. A security vulnerability exists in CSZCMS version v.1.3.0, which originates from a cross-site scripting vulnerability in the Additional Meta Tag parameter of the Pages Content Menu component...
Craft CMS unauthenticated Remote Code Execution (RCE)
This module exploits Remote Code Execution vulnerability CVE-2023-41892 in Craft CMS which is a popular content management system. Craft CMS versions between 4.0.0-RC1 - 4.4.14 are affected by this vulnerability allowing attackers to execute arbitrary code remotely, potentially compromising the...
The vulnerability of the require_once component in the PHP-Fusion CMS system allows a hacker to execute arbitrary code.
The vulnerability of the requireonce component in the PHP-Fusion CMS system relates to the ability to implement functionality from an untrusted management environment. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by loading a specially crafted php file...
CVE-2023-41601
Multiple cross-site scripting XSS vulnerabilities in install/index.php of CSZ CMS v1.3.0 allow attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Database Username or Database Host parameters...
GHSA-4G27-Q2W9-M8M8 Magento affected by remote code execution vulnerability in the CMS page scheduled update feature
Magento versions 2.4.2 and earlier, 2.4.2-p1 and earlier and 2.3.7 and earlier are affected by an Improper input validation vulnerability within the CMS page scheduled update feature. An authenticated attacker with administrative privilege could leverage this vulnerability to achieve remote code...
CuppaCMS 代码注入漏洞
CuppaCMS is a content management system CMS. A code execution vulnerability exists in CuppaCMS v1.0, which stems from the emailoutgoing parameter of the /Configuration.php file failing to properly filter the special elements of a constructed snippet. An attacker can exploit this vulnerability to...
CVE-2023-24674
Permissions vulnerability found in Bludit CMS v.4.0.0 allows local attackers to escalate privileges via the role:admin parameter...
iCMS 访问控制错误漏洞
iCMS is a software application. An efficient and simple content management system built with PHP and MySQL. An access control error vulnerability exists in iCMS versions prior to 2.16.1, which stems from incorrect access control in the administrator account management function...
iCMS2 跨站脚本漏洞
iCMS is a software application. An efficient and simple content management system built with PHP and MySQL. A cross-site scripting vulnerability exists in iCMS2 versions prior to 2.16.1-git, which is rooted in vulnerability to stored cross-site scripting XSS attacks...
iCMS2 跨站脚本漏洞
iCMS is a software application. An efficient and simple content management system built with PHP and MySQL. A cross-site scripting vulnerability exists in iCMS2 versions prior to 2.16.1, which stems from vulnerability to reflective cross-site scripting XSS attacks...
CVE-2023-39578
A stored cross-site scripting XSS vulnerability in the Create function of Zenario CMS v9.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Menu navigation text field...
CVE-2023-39599
Cross-Site Scripting XSS vulnerability in CSZ CMS v.1.3.0 allows attackers to execute arbitrary code via a crafted payload to the Social Settings parameter...
CVE-2023-39599
Cross-Site Scripting XSS vulnerability in CSZ CMS v.1.3.0 allows attackers to execute arbitrary code via a crafted payload to the Social Settings parameter...
CSZ CMS 跨站脚本漏洞
CSZ CMS is an open source PHP-based content management system CMS. A cross-site scripting vulnerability exists in CSZ CMS version v.1.3.0, which stems from a vulnerability that allows an attacker to execute arbitrary code via the Social Settings parameter using a crafted payload...
OpenRapid RapidCMS SQL注入漏洞
OpenRapid RapidCMS is OpenRapid open source a fast and easy to use CMS system. A SQL injection vulnerability exists in OpenRapid RapidCMS version 1.3.1, which stems from the incorrect manipulation of the parameter id can lead to sql injection...