CVE-2021-39203

WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions authenticated users who don't have permission to view private post types/data can bypass restrictions in the block editor under certain conditions. This...

CVE-2021-39200

WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions output data of the function wpdie can be leaked under certain conditions, which can include data like nonces. It can then be used to perform actions on yo...

Double free

WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions output data of the function wpdie can be leaked under certain conditions, which can include data like nonces. It can then be used to perform actions on yo...

Double free

WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions the widgets editor introduced in WordPress 5.8 beta 1 has improper handling of HTML input in the Custom HTML feature. This leads to stored XSS in the cust...

CVE-2021-39201

WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. Impact The issue allows an authenticated but low-privileged user like contributor/author to execute XSS in the editor. This bypasses the restrictions imposed on users who do n...

CVE-2021-39203

WordPress 5.8 beta was affected: authenticated users could bypass restrictions in the block editor to view private post types/data under certain conditions. The issue is fixed in the final WordPress 5.8 release; no exploitation details are provided beyond the described bypass during testing.

CVE-2021-39203

WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions authenticated users who don't have permission to view private post types/data can bypass restrictions in the block editor under certain conditions. This...

CVE-2021-39202

CVE-2021-39202 affects WordPress during the 5.8 beta phase, where the widget editor’s Custom HTML input was mishandled, enabling stored XSS in the custom HTML widget. The issue is tied to the beta period of WordPress 5.8 and has been patched in WordPress 5.8. Affected details in provided document...

CVE-2021-39201

WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. Impact The issue allows an authenticated but low-privileged user like contributor/author to execute XSS in the editor. This bypasses the restrictions imposed on users who do n...

CVE-2021-39201

CVE-2021-39201 affects WordPress and allows an authenticated, low-privileged user (e.g., contributor/author) to trigger cross-site scripting in the editor by bypassing the unfiltered_html restriction. The issue is fixed in WordPress 5.8; older versions are expected to receive patches via minor re...

dotCMS file upload vulnerability

dotCMS is a powerful Java-based content management system CMS. dotCMS 5.2.3 and earlier versions are vulnerable to file uploads. A remote attacker can exploit this vulnerability to execute arbitrary code via /src/main/java/com/dotmarketing/filters/CMSFilter.java...

The vulnerability of the PopojiCMS content management system arises from the lack of measures taken to protect the website structure. This allows attackers to execute arbitrary web or HTML scripts.

The vulnerability in the /admin.php?mod=user&act=addnew function of the PopojiCMS content management system exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary web or HTML scripts by using a special...

EyouCMS Cross-Site Scripting Vulnerability (CNVD-2021-82430)

EyouCms is a free and open source enterprise content management system based on the TP5.0 framework that focuses on the needs of enterprise website users. A remote attacker can use the title parameter in the bindemail function to inject arbitrary web script or HTML...

EyouCMS Cross-Site Scripting Vulnerability (CNVD-2021-82428)

EyouCms is a free and open source enterprise content management system based on the TP5.0 framework that focuses on the needs of enterprise website users. The vulnerability stems from the lack of validation of input data in Eyoucms. An attacker could use this vulnerability to inject malicious cod...

CVE-2021-39192

Ghost is a Node.js content management system. An error in the implementation of the limits service between versions 4.0.0 and 4.9.4 allows all authenticated users including contributors to view admin-level API keys via the integrations API endpoint, leading to a privilege escalation vulnerability...

WTCMS Cross-site Request Forgery Vulnerability (CNVD-2021-69267)

WTCMS is a content management system CMS based on ThinkPHP. index.php?g=admin in WTCMS...

WTCMS Cross-Site Scripting Vulnerability (CNVD-2021-69272)

WTCMS is a content management system CMS based on ThinkPHP. a cross-site scripting vulnerability exists in the link address field under the link module of the WTCMS backend. No details of the vulnerability are currently available...

WTCMS 跨站请求伪造漏洞

WTCMS is a content management system CMS based on ThinkPHP. index.php?g=admin in WTCMS...

WTCMS 跨站脚本漏洞

WTCMS is a content management system CMS based on ThinkPHP.A cross-site scripting vulnerability exists in the link fields under the menu management module of the WTCMS backend. No detailed vulnerability details are provided at this time...

Yzmcms 代码问题漏洞

YzmCMS is a lightweight open source content management system based on PHP Mysql architecture developed solely by Yuan Zhimeng. a server-side request forgery vulnerability exists in the grabimage function in YzmCMS version 5.5. No detailed vulnerability details are provided...