CVE-2023-38491 Kirby vulnerable to Cross-site scripting (XSS) from MIME type auto-detection of uploaded files

Kirby is a content management system. A vulnerability in versions prior to 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6 affects all Kirby sites that might have potential attackers in the group of authenticated Panel users or that allow external visitors to upload an arbitrary file to the content...

Information disclosure

Kirby is a content management system. A vulnerability in versions prior to 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6 affects all Kirby sites that might have potential attackers in the group of authenticated Panel users or that allow external visitors to update a Kirby content file e.g. via a...

CVE-2023-38490 Kirby XML External Entity (XXE) vulnerability in the XML data handler

Kirby is a content management system. A vulnerability in versions prior to 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6 only affects Kirby sites that use the Xml data handler e.g. Data::decode$string, 'xml' or the Xml::parse method in site or plugin code. The Kirby core does not use any of the...

CVE-2023-38489

CVE-2023-38489 – Kirby Insufficient Session Expiration (modeled across multiple sources) Kirby CMS versions prior to 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6 are affected. The vulnerability arises because old sessions were not invalidated when a user’s password was changed, allowing a previo...

CVE-2023-38488

CVE-2023-38488 is a field-injection vulnerability in Kirby’s KirbyData text storage handler. Affected versions include prior to 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6, impacting sites where authenticated Panel users or external visitors can write Kirby content files (e.g., via forms). The ...

October CMS 跨站脚本漏洞

October CMS is an open source content management system CMS based on PHP and Laravel web application framework. A security vulnerability exists in October CMS version v3.4.4, which stems from an arbitrary file upload vulnerability in October CMS...

CVE-2023-36806

Contao XSS via input unit widget (CVE-2023-36806) affects Contao CMS versions prior to 4.9.42, 4.13.28, and 5.1.10 where untrusted backend users can inject code into headline fields, executed in backend previews and on the frontend. Root cause: lack of input validation in the widget used for head...

CVE-2023-34235

Strapi is an open-source headless content management system. Prior to version 4.10.8, it is possible to leak private fields if one is using the tnumber prefix. Knex query allows users to change the default prefix. For example, if someone changes the prefix to be the same as it was before or to...

CVE-2023-34235

Strapi (pre-4.10.8) is vulnerable to information disclosure due to a Knex query that allows changing the default field prefix (t(number)). If the t-number prefix is used, private fields like password can be exposed, as t1.password is not protected. The issue can lead to filtering attacks affectin...

CVE-2023-34235 Leaking sensitive user information still possible by filtering on private with prefix fields

Strapi is an open-source headless content management system. Prior to version 4.10.8, it is possible to leak private fields if one is using the tnumber prefix. Knex query allows users to change the default prefix. For example, if someone changes the prefix to be the same as it was before or to...

CVE-2023-34093

Strapi (open-source CMS) prior to version 4.10.8 is vulnerable to information disclosure due to improper handling of Content-Type attributes. The issue arises from the removal of the privateAttributes getter when users extend or modify content-types, which can cause any attribute to become public...

Insurance 跨站脚本漏洞

Insurance is a responsive business and insurance related web content management system CMS from the phpscriptpoint team. A cross-site scripting vulnerability exists in Insurance version 1.2, which stems from the inclusion of unknown functions in the file page.php, resulting in cross-site scriptin...

CVE-2023-36339

An access control issue in WebBoss.io CMS v3.7.0.1 allows attackers to access the Website Backup Tool via a crafted GET request...

Adrian indico 跨站脚本漏洞

Adrian indico is an application of Adrian open source . A hierarchical content management system. A cross-site scripting vulnerability exists in versions prior to Adrian indico 3.2.6, which stems from vulnerability to cross-site scripting attacks...

WebBoss.io 安全漏洞

WebBoss.io is a website building platform for professional designers and developers from WebBoss.io. A security vulnerability exists in WebBoss.io CMS version v3.7.0, which stems from an access control issue that allows an attacker to access the website backup tool via a crafted GET request...

CVE-2023-37164

Diafan CMS v6.0 was discovered to contain a reflected cross-site scripting via the catid parameter at /shop/?module=shop&action=search...

Active IT zone Active Super Shop CMS 跨站脚本漏洞

Active It Zone Active IT zone Active Super Shop CMS is a Super Shop CMS from Active It Zone Inc. A cross-site scripting vulnerability exists in Active It Zone Active Super Shop CMS version 2.5, which stems from the parameter name/phone/address in the component Manage Details Page that can lead to...

Security Bulletin: Enterprise Content Management System Monitor is affected by a vulnerability in Oracle Java SE

Summary There is a vulnerability in Oracle Java SE used by Enterprise Content Management System Monitor. Enterprise Content Management System Monitor has addressed the applicable CVE. Vulnerability Details CVEID:CVE-2023-21930 DESCRIPTION: An unspecified vulnerability in Oracle Java SE, Oracle...

CVE-2023-37269

Winter is a free, open-source content management system CMS based on the Laravel PHP framework. Users with the backend.managebranding permission can upload SVGs as the application logo. Prior to version 1.2.3, SVG uploads were not sanitized, which could have allowed a stored cross-site scripting...

Cross site scripting

Winter is a free, open-source content management system CMS based on the Laravel PHP framework. Users with the backend.managebranding permission can upload SVGs as the application logo. Prior to version 1.2.3, SVG uploads were not sanitized, which could have allowed a stored cross-site scripting...