Zenar Content Management System Cross Site Scripting

Exploit Title: Zenar Content Management System - Cross-Site Scripting Software Link: https://zenar.io/ Dork: N/A Author: Berk Dusunur Tested Website: http://demo.zenar.io Date: 2018-05-20 Category: Web App PoC GET Request: POST /zenario/ajax.php?methodcall=refreshPlugin&inIframe=true HTTP/1.1 Hos...

Zenar Content Management System - Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: Zenar Content Management System - Cross-Site Scripting Software Link: https://zenar.io/ Dork: N/A Author: Berk Dusunur Tested Website: http://demo.zenar.io Category: Web App PoC GET Request: POST...

Zenar Content Management System - Cross-Site Scripting

Zenar Content Management System - Cross-Site Scripting Exploit Title: Zenar Content Management System - Cross-Site Scripting Software Link: https://zenar.io/ Dork: N/A Author: Berk Dusunur Tested Website: http://demo.zenar.io Date: 2018-05-20 Category: Web App PoC GET Request: POST...

Monstra CMS 3.0.4 - Cross-Site Scripting (2)

Monstra CMS 3.0.4 - Cross-Site Scripting 2 Exploit Title: Monstra CMS 3.0.4 - Cross-Site Scripting Date: 2018-05-17 Exploit Author: Berk Dusunur Vendor Homepage: https://monstra.org Software Link: https://monstra.org Version: before 3.0.4 Tested on: Pardus / Win10 AppServer Proof Of Concept Monst...

DOM-type cross-site scripting vulnerabilities in the front-end of Xingyunhai CMS (XYHcms)

Xing Yunhai CMS XYHcms is a completely open source CMS content management system. Xing Yunhai CMS XYHcms front-end DOM-type cross-site scripting vulnerabilities. Attackers can use the vulnerability to insert js code in the packet to obtain user cookies and other information...

Monstra CMS Cross Site Scripting

Exploit Title: Monstra CMS 3.0.4 - Cross-Site Scripting Date: 2018-05-17 Exploit Author: Berk Dusunur Vendor Homepage: https://monstra.org Software Link: https://monstra.org Version: before 3.0.4 Tested on: Pardus / Win10 AppServer Proof Of Concept Monstra is a modern and lightweight Content...

e107 Cross-Site Request Forgery Vulnerability (CNVD-2018-09821)

e107 is an open source, free and PHP and MySQL based Content Management System CMS developed by the e107 team. The system supports a variety of plug-ins and appearance of the theme , can be used as a personal blog , discussion community , archive repository and so on. A cross-site request forgery...

SQL Injection Vulnerability in Jinbao Technology's CMS Website Building System

Shanghai Jinbao Network Technology Co., Ltd. is a set of website construction, SEO optimization, network promotion, Shanghai website production, Shanghai SEO optimization, Shanghai network optimization, and many other network services as one of the integrated service-oriented professional network...

[SECURITY] Fedora 27 Update: drupal7-7.59-1.fc27

Equipped with a powerful blend of features, Drupal is a Content Management System written in PHP that can support a variety of websites ranging from personal weblogs to large community-driven websites. Drupal is highly configurable, skinnable, and secure...

[SECURITY] Fedora 26 Update: drupal7-7.59-1.fc26

Equipped with a powerful blend of features, Drupal is a Content Management System written in PHP that can support a variety of websites ranging from personal weblogs to large community-driven websites. Drupal is highly configurable, skinnable, and secure...

Code Execution Vulnerability in DedeCMS Backend

Dream Content Management System DedeCMS is a PHP open source website management system. A code execution vulnerability exists in the DedeCMS backend. An attacker can exploit the vulnerability to execute arbitrary PHP code...

[SECURITY] Fedora 28 Update: drupal7-7.59-1.fc28

Equipped with a powerful blend of features, Drupal is a Content Management System written in PHP that can support a variety of websites ranging from personal weblogs to large community-driven websites. Drupal is highly configurable, skinnable, and secure...

Arbitrary file read vulnerability in cms made simple backend for normal users

CMS Made Simple is an open source content management system. It is built using PHP and Smarty Engine , which separates content , functionality and templates . cms made simple version 2.2.7 version of the background for file preview there is an arbitrary file read vulnerability , an attacker can...

GeniXCMS Cross-Site Scripting Vulnerability (CNVD-2018-08912)

MetalGenix GeniXCMS is a PHP-based content management system and framework CMSF from MetalGenix Indonesia, which provides modules for user management, content management and menu management. A cross-site scripting vulnerability exists in MetalGenix GeniXCMS version 1.1.0. A remote attacker can...

Code execution vulnerability in cms made simple backend

CMS Made Simple is an open source content management system. It is built using PHP and Smarty Engine , which separates content , functionality and templates . cms made simple version 2.2.7 has a code execution vulnerability in the backend when performing module import, which can be exploited by a...

WUZHI CMS Cross-Site Request Forgery Vulnerability (CNVD-2018-08779)

WUZHI CMS is China's five fingers WUZHI Internet technology company based on PHP and MySQL open source content management system CMS. A cross-site request forgery vulnerability exists in WUZHI CMS version 4.1.0. A remote attacker can use index.php?m=content&f=content&v=recycledelete to delete any...

CVE-2018-9921

In CMS Made Simple 2.2.7, a Directory Traversal issue makes it possible to determine the existence of files and directories outside the web-site installation directory, and determine whether a file has contents matching a specified checksum. The attack uses an admin/checksum.php?c= request...

PT-2018-9781 · Wuzhi · Wuzhi Cms

Name of the Vulnerable Software and Affected Versions: WUZHI CMS version 4.1.0 Description: A CSRF issue allows deletion of any article via the "index.php?m=content&f=content&v=recycle delete" endpoint. Recommendations: For WUZHI CMS version 4.1.0, update to a newer version that contains a fix fo...

ucms v1.4.5 Arbitrary File Editing Vulnerability

UCMS is a simple open source content management system. ucms v1.4.5 version of the existence of arbitrary file editing vulnerability, the attacker can edit any script file, directly write a sentence Trojan horse, to obtain control of the web server...

CVE-2018-10236

POSCMS 3.2.18 allows remote attackers to execute arbitrary PHP code via the diy\dayrui\controllers\admin\Syscontroller.php 'add' function because an attacker can control the value of $data'name' with no restrictions, and this value is written to the FCPATH.$file file...