CVE-2023-34251

Grav (flat‑file CMS) versions before 1.7.42 are vulnerable to server‑side template injection (SSTI) that can enable remote code execution when a user with page editing privileges embeds malicious PHP on the administrator screen. The issue is mitigated by a fix in version 1.7.42. Public details in...

CVE-2023-3235

A vulnerability was found in mccms up to 2.6.5. It has been rated as critical. Affected by this issue is the function picapi of the file sys/apps/controllers/admin/Comic.php. The manipulation of the argument url leads to server-side request forgery. The attack may be launched remotely. The exploi...

UJCMS 代码问题漏洞

UJCMS is a Java open source content management system from UJCMS Open Source. A security vulnerability exists in UJCMS version 6.0.2 that stems from allowing arbitrary file uploads...

OTCMS 安全漏洞

OTCMS Nettie CMS is a content management system CMS for article-based websites. A security vulnerability exists in OTCMS versions prior to 6.62, which stems from path traversal due to misuse of the parameter file...

Grav 代码注入漏洞

Grav is an extensible CMS Content Management System for personal blogs, small content publishing platforms, and one-page product displays. A code injection vulnerability exists in Grav versions prior to 1.7.42, which stems from the presence of a server-side template injection SSTI vulnerability...

CVE-2023-34247 @keystone-6/auth Open Redirect vulnerability

Keystone is a content management system for Node.JS. There is an open redirect in the @keystone-6/auth package versions 7.0.0 and prior, where the redirect leading / filter can be bypassed. Users may be redirected to domains other than the relative host, thereby it might be used by attackers to...

FUEL CMS SQL注入漏洞

FUEL CMS is a content management system CMS based on the Codelgniter framework. A security vulnerability exists in FUEL CMS v1.5.2, which is caused by an SQL injection vulnerability in the id parameter of the /controllers/Blocks.php page...

openssl: use-after-free following BIO_new_NDEF

A use-after-free vulnerability was found in OpenSSL's BIOnewNDEF function. The public API function BIOnewNDEF is a helper function used for streaming ASN.1 data via a BIO. It is primarily used internally by OpenSSL to support the SMIME, CMS, and PKCS7 streaming capabilities, but it may also be...

CVE-2023-33690

SonicJS up to v0.7.0 allows attackers to execute an authenticated path traversal when an attacker injects special characters into the filename of a backup CMS...

emlog 代码问题漏洞

emlog is a PHP and MySQL based CMS builder for emlog personal developers. A code issue vulnerability exists in emlog version 6.0.0, which stems from a file upload vulnerability in /admin/plugin.php. An attacker can exploit this vulnerability to elevate privileges...

CVE-2023-33181

Xibo is a content management system CMS. Starting in version 3.0.0 and prior to version 3.3.5, some API routes will print a stack trace when called with missing or invalid parameters revealing sensitive information about the locations of paths that the server is using. Users should upgrade to...

CVE-2023-33181 Sensitive Information Disclosure abusing Stack Trace in Xibo CMS

Xibo is a content management system CMS. Starting in version 3.0.0 and prior to version 3.3.5, some API routes will print a stack trace when called with missing or invalid parameters revealing sensitive information about the locations of paths that the server is using. Users should upgrade to...

CVE-2023-33181

CVE-2023-33181 affects Xibo CMS. From version 3.0.0 up to 3.3.4, some API routes emit a stack trace on calls with missing or invalid parameters, exposing sensitive information about server path locations. Upgrade to version 3.3.5 to fix the issue; there are no public workarounds besides upgrading...

CVE-2023-33180 Sensitive Information Disclosure abusing SQL Injection in Xibo CMS display map

Xibo is a content management system CMS. An SQL injection vulnerability was discovered starting in version 3.2.0 and prior to version 3.3.2 in the /display/map API route inside the CMS. This allows an authenticated user to exfiltrate data from the Xibo database by injecting specially crafted valu...

SeaCMS Denial of Service Vulnerability (CNVD-2024-37629)

SeaCMS is designed to solve the core needs of station owners and content management system, a set of programs to adapt to computers, cell phones, tablets, APP multiple terminal entrances, without any encryption code, safe and secure, is the best station building tools. SeaCMS 11.6 version of the...

Xibo 路径遍历漏洞

Xibo is an open source content management system from Xibo Digital Signage. A security vulnerability exists in Xibo that stems from a path traversal vulnerability that allows an authenticated user to upload a specially crafted zip file to the CMS, which would allow a user acting as a web server t...

mipjz 跨站脚本漏洞

mipjz is sansanyun individual developers of a set of Baidu Mobile Accelerator MIP-based content management system . A security vulnerability exists in mipjz version v5.0.5, which stems from a stored cross-site scripting XSS vulnerability that allows an attacker to execute arbitrary web script or...

WUZHI CMS 跨站脚本漏洞

WUZHI CMS is a PHP and MySQL based open source content management system CMS from Wuzhi WUZHI. A security vulnerability exists in Wuzhi CMS version v3.1.2, which stems from a stored XSS vulnerability in the backend...

CVE-2023-31816

IT Sourcecode Content Management System Project In PHP and MySQL With Source Code 1.0.0 is vulnerable to Cross Site Scripting XSS via /ecodesource/searchlist.php...

CVE-2023-31816

The CVE-2023-31816 entry concerns IT Sourcecode Content Management System (PHP/MySQL) v1.0.0 that is vulnerable to Cross-Site Scripting (XSS) via the endpoint /ecodesource/search_list.php. The vulnerability is described across sources (NVD, Red Hat, CVE listings) with the core issue being an XSS ...