CVE-2017-7255

XSS exists in the CMS Made Simple CMSMS 2.1.6 "Content--News--Add Article" feature via the m1title parameter. Someone must login to conduct the attack...

Cross site scripting

XSS exists in the CMS Made Simple CMSMS 2.1.6 "Content--News--Add Article" feature via the m1summary parameter. Someone must login to conduct the attack...

Cross site scripting

XSS exists in the CMS Made Simple CMSMS 2.1.6 "Content--News--Add Article" feature via the m1title parameter. Someone must login to conduct the attack...

CVE-2017-7255

CVE-2017-7255 describes a cross-site scripting (XSS) vulnerability in CMS Made Simple (CMSMS) 2.1.6, triggered in the Content→News→Add Article workflow via the m1_title parameter. Affected software is CMSMS; the issue is a reflected/stored XSS caused by unsanitized input in the m1_title field, wi...

CVE-2017-7257

XSS exists in the CMS Made Simple CMSMS 2.1.6 "Content--News--Add Article" feature via the m1content parameter. Someone must login to conduct the attack...

CVE-2017-7257

CVE-2017-7257 describes a cross-site scripting (XSS) vulnerability in CMS Made Simple (CMSMS) 2.1.6, specifically in the Content→News→Add Article feature via the m1_content parameter. The description notes that an attacker must be logged in to perform the attack, and the vulnerability affects the...

CVE-2017-7256

XSS exists in the CMS Made Simple CMSMS 2.1.6 "Content--News--Add Article" feature via the m1summary parameter. Someone must login to conduct the attack...

PT-2017-17615 · Cmsms · Cms Made Simple

Name of the Vulnerable Software and Affected Versions: CMS Made Simple CMSMS version 2.1.6 Description: A security issue exists in the "Content--News--Add Article" feature of the software, where an attacker can exploit the m1 summary parameter to conduct a cross-site scripting XSS attack. This...

SQL Injection Vulnerability in Webkravat Content Management System ic.php Page

Webkrava is a small cms system by php+mysql. A SQL injection vulnerability exists in the ic.php page of the Webkravat content management system. The lack of filtering of the 'id' parameter allows an attacker to exploit the vulnerability to obtain sensitive information about the database...

Fastspot BigTree CMS Cross-Site Request Forgery Vulnerability (CNVD-2017-03386)

Fastspot BigTree CMS is the United States Fastspot company based on PHP and MySQL open source content management system CMS. A cross-site request forgery vulnerability exists in Fastspot BigTree CMS versions 4.1.18 and 4.2.16. A remote attacker can exploit this vulnerability to delete users with...

Fastspot BigTree CMS Cross-Site Request Forgery Vulnerability (CNVD-2017-03389)

Fastspot BigTree CMS is the United States Fastspot company based on PHP and MySQL open source content management system CMS. A cross-site request forgery vulnerability exists in Fastspot BigTree CMS version 4.2.16. The vulnerability can be exploited by an attacker to perform unauthorized operatio...

Arbitrary File Deletion Vulnerability in CWCMS admin/cw_ad.php Page

CWCMS is an enterprise website management system. An arbitrary file deletion vulnerability exists in the CWCMS admin/cwad.php page. An attacker can exploit this vulnerability to delete arbitrary files from the website...

iBaseCMS 1.23 SQL Injection / File Upload Vulnerabilities

Exploit for php platform in category web applications Title: iBaseCMS - SQl Injection / File Upload / Remote Code Execution via arbitrary file upload Credit: Bilal KARDADOU Vendor: iOnline Vendor URL: http://www.ibasecms.nl Product: iBaseCMS "CONTENT MANAGEMENT SYSTEM" Google Dork: N/A --SQL...

iBaseCMS 1.23 SQL Injection / File Upload

Title: iBaseCMS - SQl Injection / File Upload / Remote Code Execution via arbitrary file upload Credit: Bilal KARDADOU Vendor: iOnline Vendor URL: http://www.ibasecms.nl Product: iBaseCMS "CONTENT MANAGEMENT SYSTEM" Google Dork: N/A --SQL Injection/Exploit--...

MBLS Flex CMS 0.7.2 SQL Injection / Cross Site Scripting

Title: SQL injection & Cross-site scripting in CMS Flex Credit: Bilal KARDADOU Vulnerability: SQL injection & Cross-Site scripting Vulnerable version: Flex Version 0.7.2 Vendor: MBL Solutions Ltd Vendor URL: http://www.mblsolutions.co.uk/ Product: FLEX CMS "THE INTUITIVE CONTENT MANAGEMENT SYSTEM...

Elefant CMS 1.3.12-RC Cross Site Request Forgery

Security Advisory - Curesec Research Team 1. Introduction Affected Product: Elefant CMS 1.3.12-RC Fixed in: 1.3.13 Fixed Version https://github.com/jbroadway/elefant/releases/tag/ Link: elefant1313rc Vendor Website: https://www.elefantcms.com/ Vulnerability CSRF Type: Remote Yes Exploitable:...

dotCMS 3.6.1 Blind Boolean SQL Injection

Blind Boolean SQL Injection in dotCMS = 3.6.1 CVE-2017-5344 Product Description dotCMS is a scalable, java based, open source content management system CMS that has been designed to manage and deliver personalized, permission based content experiences across multiple channels. dotCMS can serve as...

Ionize Arbitrary Code Execution Vulnerability

ionize is a CMS system developed using CodeIgniter. A cross-site scripting vulnerability exists in Ionize version 1.0.8 due to the program failing to adequately validate user-supplied input. An attacker can exploit this vulnerability to execute arbitrary HTML and script code in a user's browser...

Cross-site scripting vulnerability in 'index.php' page of DM website builder system

DM enterprise building system is developed by php + mysql a set of specialized in small and medium-sized enterprise website construction of open source cms. A cross-site scripting vulnerability exists in the 'index.php' page of the DM website builder system. The program fails to filter...

CSRF vulnerability in icms backend

iCMS is an efficient content management system for small and medium-sized websites. A csrf vulnerability exists in the latest version of iCMS. Because the token is not validated in the /app/admincp/account.app.php dosave operation, an attacker can modify the administrator account password by...