PT-2023-36386 · Undefined · Undefined

🚨 CVE-2023-38911 A Cross-Site Scripting XSS vulnerability in CSZ CMS 1.3.0 allows attackers to execute arbitrary code via a crafted payload to the Gallery parameter in the YouTube URL fields. 🎖@cveNotify...

CSZ CMS 跨站脚本漏洞

CSZ CMS is an open source PHP-based content management system CMS. A security vulnerability exists in CSZ CMS version 1.3.0, which stems from a vulnerability that allows an attacker to execute arbitrary code via the Gallery parameter in the YouTube URL field using a carefully crafted payload...

Ghost Arbitrary File Read Vulnerability

Ghost is an open source content management system . Ghost suffers from an arbitrary file read vulnerability that stems from the program failing to properly filter for special elements in a resource or file path. An attacker can exploit this vulnerability to read arbitrary files...

Minimati SQL注入漏洞

Minimati is a simple, lightweight and open source CMS by Kidus Personal Developers. A security vulnerability exists in Minimati version v.1.0.0, which stems from the presence of a SQL injection vulnerability that allows remote attackers to obtain sensitive information via the edit.php component...

CVE-2023-40028 Arbitrary file read via symlinks in Ghost

Ghost is an open source content management system. Versions prior to 5.59.1 are subject to a vulnerability which allows authenticated users to upload files that are symlinks. This can be exploited to perform an arbitrary file read of any file on the host operating system. Site administrators can...

ThinkCMF Cross-Site Scripting Vulnerability

ThinkCMF is a CMS Content Management System based on ThinkPHP. A cross-site scripting vulnerability exists in ThinkCMF version 5.1.5, which stems from the lack of effective filtering and escaping of user-supplied data in the file UserController.php, and can be exploited by an attacker to execute...

SEMCMS File Upload Vulnerability

SEMCMS is a foreign trade web content management system CMS that supports multiple languages. A file upload vulnerability exists in SEMCMS version 3.9, which stems from the application's lack of effective validation of uploaded files and can be exploited by an attacker to run arbitrary code via...

Textpattern CMS Path Traversal Vulnerability

Textpattern CMS is a Php-based content management system from the Textpattern team. A security vulnerability exists in Textpattern CMS version v4.8.8. A remote attacker can exploit the vulnerability to execute arbitrary code and access sensitive information via the plugin upload function...

idreamsoft iCMS SQL Injection Vulnerability

idreamsoft iCMS is an open source content management system CMS based on PHP and MySQL. A SQL injection vulnerability exists in idreamsoft iCMS. No information about this vulnerability is available at this time, please stay tuned to CNNVD or vendor announcements...

DedeBIZ 跨站脚本漏洞

DedeBIZ is a content management system from China Muyun Intelligent Technology DedeBIZ company. A cross-site scripting vulnerability exists in DedeBIZ version 6.2.10, which stems from the Article Handler component can lead to cross-site scripting vulnerability. No detailed vulnerability details a...

idreamsoft iCMS Cross-Site Scripting Vulnerability

idreamsoft iCMS is an open source content management system CMS based on PHP and MySQL. A cross-site scripting vulnerability exists in versions prior to idreamsoft iCMS 2.16.1-git. An attacker can exploit this vulnerability to perform cross-site scripting attacks...

Security feature bypass

Sulu is an open-source PHP content management system based on the Symfony framework. It allows over the Admin Login form to detect which user username, email exists and which one do not exist. Sulu Installation not using the old Symfony 5.4 security System and previous version are not impacted by...

CVE-2023-39343 Sulu Observable Response Discrepancy on Admin Login

Sulu is an open-source PHP content management system based on the Symfony framework. It allows over the Admin Login form to detect which user username, email exists and which one do not exist. Sulu Installation not using the old Symfony 5.4 security System and previous version are not impacted by...

Omeka S Code Issue Vulnerability

Omeka S is an open source web content management system CMS from Omeka, Inc. that specializes in creating and managing digital exhibitions and online digital archives. It is a new version of the Omeka project, and unlike the traditional Omeka Classic, Omeka S emphasizes multi-user collaboration a...

CVE-2023-39096

WebBoss.io CMS v3.7.0.1 contains a stored Cross-Site Scripting XSS vulnerability due to lack of input validation and output encoding...

CVE-2023-39097

WebBoss.io CMS v3.7.0.1 contains a stored cross-site scripting XSS vulnerability...

Number withdrawn

silverstripe framework is a set of CMS website frameworks. This CVE number has been withdrawn...

SEMCMS SQL注入漏洞

SEMCMS is a foreign trade web content management system CMS that supports multiple languages. SEMCMS version 1.5 suffers from a SQL injection vulnerability, which originates from the lack of validation of external input SQL statements in the parameter id of /AntSuxin.php, which can be exploited b...

CVE-2023-38492 Kirby vulnerable to denial of service from unlimited password lengths

Kirby is a content management system. A vulnerability in versions prior to 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6 affects all Kirby sites with user accounts unless Kirby's API and Panel are disabled in the config. The real-world impact of this vulnerability is limited, however we still...

CVE-2023-38491 Kirby vulnerable to Cross-site scripting (XSS) from MIME type auto-detection of uploaded files

Kirby is a content management system. A vulnerability in versions prior to 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6 affects all Kirby sites that might have potential attackers in the group of authenticated Panel users or that allow external visitors to upload an arbitrary file to the content...