Shift Tech bingo!CMS 授权问题漏洞

Shift Tech bingo!CMS is a content management system from Shift Tech Japan. An authorization issue vulnerability exists in Shift Tech bingo!CMS version 1.7.4.1 and prior versions, which stems from an authentication bypass vulnerability contained in certain administrative functions...

Desdev DedeCMS 代码问题漏洞

Desdev DedeCMS Dream Weaving Content Management System is a PHP-based open-source content management system CMS of China Zhuozhuo network Desdev company. The system has content publishing, content management, content editing and content retrieval functions. DedeCMS V5.7.99 version of a security...

The vulnerability of the “id” parameter in the “team.php”, “player.php”, and “club.php” scripts of the KandNconcepts Club CMS allows a hacker to perform XSS attacks.

The vulnerability of the “id” parameter in the “team.php”, “player.php”, and “club.php” scripts of the KandNconcepts Club CMS exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks...

DNN 路径遍历漏洞

DNN also known as DotNetNuke is a set of U.S. DNN by Microsoft support , based on the ASP.NET platform for open source content management system CMS. The system is easy to install , scalable , feature-rich features . DNN 9.11.0 before the version of the path traversal vulnerability exists. An...

ZZCMS index php information leakage vulnerability

ZZCMS is a content management system CMS by the ZZCMS team in China. An information disclosure vulnerability exists in ZZCMS 2022, which stems from the program's inadequate protection of sensitive information, and can be exploited by an attacker to send a request to "/admin/index php?Server" to...

CVE-2022-39256 Orckestra C1 CMS's deserialization of untrusted data allows for arbitrary code execution.

Orckestra C1 CMS is a .NET based Web Content Management System. A vulnerability in versions prior to 6.13 allows remote attackers to execute arbitrary code on affected installations of Orckestra C1 CMS. Authentication is required to exploit this vulnerability. The authenticated user may perform t...

CVE-2022-39256

Orckestra C1 CMS before 6.13 has a deserialization vulnerability that allows an authenticated attacker to execute arbitrary code on affected installations. The issue affects the .NET-based C1 CMS and is triggered by authenticated actions (user must visit a crafted site). The root cause described ...

PT-2022-24848 · Orckestra · Orckestra C1 Cms

Name of the Vulnerable Software and Affected Versions: Orckestra C1 CMS versions prior to 6.13 Description: A vulnerability in Orckestra C1 CMS allows remote attackers to execute arbitrary code on affected installations. Authentication is required to exploit this issue. The authenticated user may...

PT-2022-7075 · Unknown · Backdrop Cms

Name of the Vulnerable Software and Affected Versions: Backdrop CMS version 1.23.0 Description: The issue is related to a stored cross-site scripting XSS vulnerability in Backdrop CMS. This vulnerability can be exploited via Post content, allowing a remote attacker to conduct cross-site scripting...

Cross-Site Scripting: The Real WordPress Supervillain

Vulnerabilities are a fact of life for anyone managing a website, even when using a well-established content management system like WordPress. Not all vulnerabilities are equal, with some allowing access to sensitive data that would normally be hidden from public view, while others could allow a...

ZZCMS SQL注入漏洞

ZZCMS is a content management system CMS by the ZZCMS team in China.ZZCMS is a content management system ZZCMS 2022 suffers from an SQL injection vulnerability that originates from an easy SQL injection attack via the parameter keyword in /admin/baojialist.php...

ZZCMS 路径遍历漏洞

ZZCMS is a content management system CMS from the ZZCMS team in China. A security vulnerability exists in ZZCMS 2022, which stems from a vulnerability that allows an attacker to obtain sensitive information via a crafted GET request sent to /one/siteinfo.php...

JFinal SQL注入漏洞

JFinal is a Java language based WEB + ORM open source framework . JFinal CMS version 5.1.0 SQL injection vulnerability exists , the vulnerability stems from the interface does not use the same components , there is no filter , but each use their own SQL splicing , resulting in SQL injection...

JFinal SQL注入漏洞

JFinal is a Java language based WEB + ORM open source framework. JFinal CMS version 5.1.0 SQL injection vulnerability , the vulnerability stems from the lack of measures to prevent sql injection , resulting in SQL injection...

PT-2022-24436 · Ucms · Ucms

Name of the Vulnerable Software and Affected Versions: UCMS version 1.6.0 Description: A cross-site scripting XSS issue was found in UCMS via the Import function under the Site Management page. This allows for potential malicious script execution. Recommendations: For UCMS version 1.6.0, consider...

CVE-2021-41731

Cross Site Scripting XSS vulnerability exists in Sourcecodester News247 News Magazine CMS PHP 5.6 or higher and MySQL 5.7 or higher via the blog category name field...

Pixel＆tonic Craft CMS 跨站脚本漏洞

Pixel & tonic Craft CMS is a content management system CMS from the US company Pixel & tonic. A cross-site scripting vulnerability exists in Craft CMS version 4.2.0.1, which stems from a security issue in the src/helpers/Cp.php page...

CVE-2022-32244

Under certain conditions an attacker authenticated as a CMS administrator access the BOE Commentary database and retrieve non-personal system data, modify system data but can't make the system unavailable. This needs the attacker to have high privilege access to the same physical/logical network ...

CVE-2022-32244

Under certain conditions an attacker authenticated as a CMS administrator access the BOE Commentary database and retrieve non-personal system data, modify system data but can't make the system unavailable. This needs the attacker to have high privilege access to the same physical/logical network ...

Default credentials

TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that the expiration time of a password reset link for TYPO3 backend users has never been evaluated. As a result, a password reset link could be used to perform a password reset even ...