MaxSite CMS Cross-Site Scripting Vulnerability (CNVD-2022-33826) (CVE-2022-25413)

MaxSite CMS is a web content management system of the Russian MaxSite CMS open source project.MaxSite CMS 108 has a cross-site scripting vulnerability that can be exploited by attackers to perform cross-site scripting attacks via the ftags parameter in /admin/pageedit/3...

PluXml Cross-Site Scripting Vulnerability (CNVD-2022-73493)

PluXml is a content management system that does not require a database to work.A cross-site scripting vulnerability exists in PluXML version 5.8.7. An attacker can exploit this vulnerability to execute arbitrary web script or HTML via a payload in the thumbnail path of a blog post...

Taocms id parameter SQL injection vulnerability

Taocms is a micro Cms content management system in China. version 3.0.2 of Taocms is vulnerable to SQL injection, which stems from the lack of validation of externally entered SQL statements by the backend parameter id. An attacker can use this vulnerability to execute illegal SQL commands to ste...

Metalgenix GeniXCMS 跨站脚本漏洞

Metalgenix GeniXCMS is a PHP-based content management system and framework CMSF from MetalGenix Metalgenix Indonesia. The system provides modules for user management, content management and menu management. A security vulnerability exists in Metalgenix GeniXCMS v1.1.11, which can be exploited by...

Maxsite CMS arbitrary file deletion vulnerability

MaxSite CMS is a web content management system of the Russian MaxSite CMS open source project . Maxsite CMS has arbitrary file deletion vulnerability , the vulnerability stems from all-files-update-ajax.php in the dir and deletefile parameters for the file name lack of validation , the attacker c...

CVE-2022-23907

CMS Made Simple v2.2.15 was discovered to contain a reflected cross-site scripting XSS vulnerability via the parameter m1fmmessage...

CMS Made Simple 代码问题漏洞

CMS Made Simple CMSMS is an open source content management system CMS from the CMSMS Cmsms team. The system supports role-based permission management system, wizard-based installation and update mechanism, intelligent caching mechanism and so on. CMS Made Simple suffers from a code issue...

BloofoxCms Cross-Site Scripting Vulnerability (CNVD-2022-17027)

BloofoxCms is a Php-based text content management system from alexlang24 personal developer. bloofoxCMS suffers from a cross-site scripting vulnerability that stems from the lack of user-supplied data and output data validation filtering in the file and type parameters in index.php. An attacker...

Strapi 安全漏洞

Strapi is an open source headless content management system CMS. Strapi is vulnerable to an operating system command injection vulnerability that originates from arbitrary command injection in the GitHub repository. No detailed vulnerability details are currently available...

WBCE CMS安全漏洞

WBCE CMS is an open source content management system CMS based on PHP and MySQL. WBCE CMS suffers from a security vulnerability that originates in /languages/index.php that allows attackers to execute arbitrary code via a crafted PHP file...

iCMS Code Injection Vulnerability

iCMS is a software application. An efficient and simple content management system built with PHP and MySQL. iCMS suffers from a code injection vulnerability that stems from the fact that iCMS allows users to add and render comtom templates, which are SSTI-vulnerable. An attacker can exploit this...

MCMS Arbitrary File Deletion vulnerability

net.mingsoft:ms-basic is used for plugin management for applications built with Maven for the Mingfei Content Management System MCMS. ms-basic before 2.1.16 is vulnerable to arbitrary file deletion using POST requests to /template/writeFileContent via the oldFileName parameter. MCMS before 5.2.11...

CVE-2021-46063

MCMS v5.2.5 was discovered to contain a Server Side Template Injection SSTI vulnerability via the Template Management module...

CVE-2021-46036

An arbitrary file upload vulnerability in the component /ms/file/uploadTemplate.do of MCMS v5.2.4 allows attackers to execute arbitrary code...

XSS Vulnerability in BossCMS of Wenzhou Huyin Information Technology Co. Ltd (CNVD-2022-21727)

BossCMS is a content management system based on self-developed PHP framework MySQL architecture developed by Wenzhou Huyin Information Technology Co. There is an XSS vulnerability in BossCMS, which can be exploited by attackers to obtain sensitive information such as user cookies...

Appleple a-blog cms 授权问题漏洞

Appleple a-blog cms is a content management system CMS from appleple Appleple Japan. The a-blog cms suffers from an authorization issue vulnerability that exists due to an error when processing authentication requests. A remote attacker could bypass the authentication process and gain unauthorize...

Command Execution Vulnerability in BossCMS of Wenzhou Huyin Information Technology Co.

BossCMS is a content management system based on self-developed PHP framework MySQL architecture developed by Wenzhou Huyin Information Technology Co. A command execution vulnerability exists in BossCMS, which can be exploited to gain server privileges...

Arbitrary File Deletion Vulnerability in BossCMS of Wenzhou Huanxin Information Technology Company Limited (CNVD-2022-21723)

BossCMS is a content management system based on self-developed PHP framework MySQL architecture developed by Wenzhou Huyin Information Technology Co. BossCMS has an arbitrary file deletion vulnerability, which can be exploited to delete any file on the server...

YzmCMS Cross-site Request Forgery Vulnerability (CNVD-2022-12752)

YzmCMS is an open source CMS Content Management System.A cross-site request spoofing vulnerability exists in YzmCMS, which stems from insufficient validation in admin.add that the request is coming from a trusted user. An attacker could use this vulnerability to spoof malicious requests to trick...

MCMS has SQL injection vulnerability (CNVD-2022-17364)

MCMS is a lightweight open source content management system developed on java.MCMS is vulnerable to SQL injection, which can be exploited by attackers to obtain sensitive database information...