4391 matches found
CuppaCMS 安全漏洞
CuppaCMS is a content management system CMS. a security vulnerability exists in CuppaCMS version 1.0, which stems from the fact that CuppaCMS reads arbitrary files via the copy function. No details of the vulnerability are currently available...
Arbitrary File Deletion Vulnerability in BossCMS of Wenzhou Huyin Information Technology Co., Ltd (CNVD-2022-42448)
BossCMS is a content management system developed by Wenzhou Huyin Information Technology Co., Ltd. based on self-developed PHP framework MySQL architecture. Ltd. BossCMS has an arbitrary file deletion vulnerability, which can be exploited to delete arbitrary files on the server...
Atom CMS SQL注入漏洞
Atom CMS is a content management system. A SQL injection vulnerability exists in Atom CMS version 2.0, which stems from a missing validation of external input SQL statements in the id parameter of /admin/ajax/avatar.php. An attacker could use this vulnerability to execute illegal SQL commands to...
Volto licensing issue vulnerability
Volto is a ReactJS-based front-end for the Plone content management system. Volto is vulnerable to an authentication vulnerability that could be exploited by attackers to replace its authentication cookies with authentication cookies from other users, effectively giving them control over other...
Authentication flaw
Volto is a ReactJS-based frontend for the Plone Content Management System. Between versions 14.0.0-alpha.5 and 15.0.0-alpha.0, a user could have their authentication cookie replaced with an authentication cookie from another user, effectively giving them control of the other user's account and...
CVE-2022-24740 Improper Authentication in Volto
Volto is a ReactJS-based frontend for the Plone Content Management System. Between versions 14.0.0-alpha.5 and 15.0.0-alpha.0, a user could have their authentication cookie replaced with an authentication cookie from another user, effectively giving them control of the other user's account and...
CVE-2022-24740
Volto (the Plone React frontend) versions 14.0.0-alpha.5 through 15.0.0-alpha.0 are vulnerable to authentication cookie replacement under high server load due to an outdated react-cookie library. This could allow an attacker to gain the other user’s account privileges. A proof of concept does not...
YzmCMS Cross-site Request Forgery Vulnerability (CNVD-2022-20583)
Yzmcms is an open source CMS Content Management System for Yzmcms individual developers. yzmCMS v6.3 has a cross-site request forgery vulnerability that allows attackers to arbitrarily delete user accounts via /admin/adminmanage/delete. No details of the vulnerability are currently available...
Orchard Coret Cross-Site Scripting Vulnerability
Net Core, an open source modular and multi-tenant application framework built using Asp.Net Core, and a content management system Cms built on top of the framework.A cross-site scripting vulnerability exists in Orchard Core, which stems from the lack of proper validation of client-side data in th...
Orchard Core Cross-Site Scripting Vulnerability (CNVD-2022-22245)
Net Core, an open source modular and multi-tenant application framework built using Asp.Net Core, and a content management system Cms built on top of the framework.A cross-site scripting vulnerability exists in Orchard Core, which stems from the lack of proper validation of client-side data in th...
Orchard Core Permissions and Access Control Issues Vulnerability
Orchard Core is an open source modular and multi-tenant application framework built with Asp.Net Core and a content management system Cms built on top of the framework from Orchard Core, Inc. Orchard Core is vulnerable to privilege permission and access control issues that could be exploited by a...
Orchard Core 跨站脚本漏洞
Net Core, an open source modular and multi-tenant application framework built using Asp.Net Core, and a content management system Cms built on top of the framework.A cross-site scripting vulnerability exists in Orchard Core, which stems from the lack of proper validation of client-side data in th...
Microweber 跨站脚本漏洞
Microweber is a drag-and-drop website builder and CMS based on the PHP Laravel framework.Microweber suffers from a cross-site scripting vulnerability that could be exploited by attackers to steal user information and phishing...
Subrion CMS Cross-Site Scripting Vulnerability (CNVD-2022-20164)
Subrion CMS is a PHP-based content management system CMS from the Subrion team. The system can be integrated into websites and supports multiple extension plugins, etc. A security vulnerability exists in Subrion CMS 4.2.1, which can be exploited by attackers via the q parameter in the Kickstart...
Victor CMS SQL Injection Vulnerability (CNVD-2022-18528)
Victor CMS is an open source content management system from Victor Alagwu, a personal developer in Nigeria.A SQL injection vulnerability exists in Victor CMS v1.0, which stems from the fact that the product does not effectively handle or escape special characters in user input data. An attacker...
Subrion CMS Cross-site Request Forgery Vulnerability (CNVD-2022-20162)
Subrion CMS is a PHP-based content management system CMS from the Subrion team. The system can be integrated into websites and supports multiple extension plugins, etc. A security vulnerability exists in Subrion CMS 4.2.1, which allows a remote, unauthenticated, malicious user to send authorizati...
The vulnerability of the Drupal content management system, related to insufficient validation of input data, allows a hacker to insert or overwrite arbitrary data.
The vulnerability of the Drupal content management system is related to insufficient validation of input data. Exploiting this vulnerability could allow a hacker to insert or overwrite arbitrary data...
MingSoft MCMS 访问控制错误漏洞
MingSoft Mcms is a complete open source J2ee system from MingSoft. MCMS 5.2.5 and previous versions have a security vulnerability that originates from net.mingsoft.basic.action.web.EditorActioneditor missing for json data The vulnerability can be exploited for remote code execution...
