UCMS Cross-Site Request Forgery Vulnerability

UCMS is a content management system written in PHP. A cross-site request forgery vulnerability exists in UCMS version 1.4.7. A remote attacker can exploit this vulnerability to create an administrator account with the help of ?do=useraddpost...

CVE-2018-20598

UCMS 1.4.7 has ?do=useraddpost CSRF...

CVE-2018-20599

UCMS 1.4.7 allows remote attackers to execute arbitrary PHP code by entering this code during an index.php sadminfileedit action...

CVE-2018-20600

sadmin\cedit.php in UCMS 1.4.7 has XSS via an index.php sadmincedit action...

CVE-2018-20597

UCMS 1.4.7 has XSS via the dir parameter in an index.php sadminfileedit action...

CVE-2018-20602

Lei Feng TV CMS aka LFCMS 3.8.6 allows full path disclosure via the /install.php?s=/1 URI...

CVE-2018-20601

UCMS 1.4.7 has XSS via the description parameter in an index.php listeditpost action...

Code injection

Ivan Cordoba Generic Content Management System CMS through 2018-04-28 has XSS via the Administrator/users.php user ID...

CVE-2018-20590

Ivan Cordoba Generic Content Management System CMS through 2018-04-28 has XSS via the Administrator/users.php user ID...

CVE-2018-20589

Ivan Cordoba Generic Content Management System CMS through 2018-04-28 has XSS via the Administrator/addpictures.php article ID...

CVE-2018-20590

CVE-2018-20590 affects the Ivan Cordoba Generic Content Management System (CMS) up to 2018-04-28. The vulnerability is a Cross-Site Scripting (XSS) flaw in the file or path used by the Administrator/users.php user ID. The linked CNVD entry describes that the XSS can allow execution of arbitrary J...

CVE-2018-20590

Ivan Cordoba Generic Content Management System CMS through 2018-04-28 has XSS via the Administrator/users.php user ID...

bludit Pages Editor 3.0.0 Arbitrary File Upload Vulnerability

Bludit is an open source and free lightweight blogging CMS Content Management System system.Pages Editor is one of the page editors. A security vulnerability exists in the content upload feature of Pages Editor in Bludit version 3.0.0, which stems from the program's failure to restrict the upload...

MetInfo Cross-Site Scripting Vulnerability (CNVD-2019-03299)

MetInfo is a content management system CMS developed using PHP and Mysql by China Mito Information Technology Ltd. A cross-site scripting vulnerability exists in MetInfo versions 6.x to 6.1.3, which can be exploited by remote attackers to execute JavaScript code by sending the 'urlarray' paramete...

S-CMS SQL Injection Vulnerability (CNVD-2018-26679)

S-CMS is a content management system CMS based on PHP and MySQL. A SQL injection vulnerability exists in S-CMS version 1.0, which can be exploited by remote attackers to execute SQL commands by sending the 'Sid' parameter to the wapindex.php?type=newsinfo URL...

S-CMS File Read Vulnerability

S-CMS is a content management system CMS based on PHP and MySQL. A file read vulnerability exists in the admin/download.php file in S-CMS version 1.0, which can be exploited by an attacker to read files with the help of the 'DownName' parameter...

S-CMS SQL Injection Vulnerability (CNVD-2018-26678)

S-CMS is a content management system CMS based on PHP and MySQL. A SQL injection vulnerability exists in S-CMS version 1.0, which can be exploited by remote attackers to execute SQL commands by sending the 'Pid' parameter to the js/pic.php file...

S-CMS SQL Injection Vulnerability (CNVD-2018-26676)

S-CMS is a content management system CMS based on PHP and MySQL. A SQL injection vulnerability exists in the bank/callback1.php file in S-CMS version 3.0, which stems from the program's failure to filter the 'Pno' field, and can be exploited by remote attackers to execute SQL statements with the...

PT-2018-15401 · S Cms · S-Cms

Name of the Vulnerable Software and Affected Versions: S-CMS version 3.0 Description: An issue in S-CMS allows cross-site scripting XSS attacks via the T id parameter in the "admin/demo.php" API endpoint. Recommendations: For S-CMS version 3.0, avoid using the T id parameter in the "admin/demo.ph...

Fastspot BigTree Information Disclosure Vulnerability

Fastspot BigTree is the United States Fastspot company based on PHP and MySQL open source content management system CMS. An information disclosure vulnerability exists in the admin/news/ page in Fastspot BigTree version 4.3, which can be exploited by an attacker to obtain path information...