1396 matches found
Craft CMS Stored Cross-site Scripting Injection Vulnerability
Summary When you insert a payload inside a label name or instruction of an entry type, an XSS happens in the quick post widget on the admin dashboard. PoC Complete instructions, including specific configuration details, to reproduce the vulnerability. Impact Tested with the free version of Craft...
GHSA-QCRJ-6FFC-V7HQ Craft CMS Stored Cross-site Scripting Injection Vulnerability
Summary When you insert a payload inside a label name or instruction of an entry type, an XSS happens in the quick post widget on the admin dashboard. PoC Complete instructions, including specific configuration details, to reproduce the vulnerability. Impact Tested with the free version of Craft...
CVE-2023-23927 Craft CMS stored cross-site scripting vulnerability
Craft is a platform for creating digital experiences. When you insert a payload inside a label name or instruction of an entry type, an cross-site scripting XSS happens in the quick post widget on the admin dashboard. This issue has been fixed in version 4.3.7...
CVE-2023-23927 Craft CMS stored cross-site scripting vulnerability
Craft is a platform for creating digital experiences. When you insert a payload inside a label name or instruction of an entry type, an cross-site scripting XSS happens in the quick post widget on the admin dashboard. This issue has been fixed in version 4.3.7...
Craft CMS 跨站脚本漏洞
Pixel & tonic Craft CMS is a content management system CMS from Pixel & tonic, USA. A cross-site scripting vulnerability exists in Craft CMS versions prior to 4.3.7, which stems from a cross-site scripting XSS vulnerability...
Craft CMS discloses password hashes
All Craft CMS versions between 3.0.0 and 3.7.32 disclose password hashes of users who authenticate using their E-Mail address or username in Anti-CSRF-Tokens. Craft CMS uses a cookie called CRAFTCSRFTOKEN and a HTML hidden field called CRAFTCSRFTOKEN to avoid Cross Site Request Forgery attacks. T...
GHSA-H972-V458-M892 Craft CMS discloses password hashes
All Craft CMS versions between 3.0.0 and 3.7.32 disclose password hashes of users who authenticate using their E-Mail address or username in Anti-CSRF-Tokens. Craft CMS uses a cookie called CRAFTCSRFTOKEN and a HTML hidden field called CRAFTCSRFTOKEN to avoid Cross Site Request Forgery attacks. T...
CVE-2022-37783
All Craft CMS versions between 3.0.0 and 3.7.32 disclose password hashes of users who authenticate using their E-Mail address or username in Anti-CSRF-Tokens. Craft CMS uses a cookie called CRAFTCSRFTOKEN and a HTML hidden field called CRAFTCSRFTOKEN to avoid Cross Site Request Forgery attacks. T...
CVE-2022-37783
All Craft CMS versions between 3.0.0 and 3.7.32 disclose password hashes of users who authenticate using their E-Mail address or username in Anti-CSRF-Tokens. Craft CMS uses a cookie called CRAFTCSRFTOKEN and a HTML hidden field called CRAFTCSRFTOKEN to avoid Cross Site Request Forgery attacks. T...
Cross site request forgery (csrf)
All Craft CMS versions between 3.0.0 and 3.7.32 disclose password hashes of users who authenticate using their E-Mail address or username in Anti-CSRF-Tokens. Craft CMS uses a cookie called CRAFTCSRFTOKEN and a HTML hidden field called CRAFTCSRFTOKEN to avoid Cross Site Request Forgery attacks. T...
CVE-2022-37783
All Craft CMS versions between 3.0.0 and 3.7.32 disclose password hashes of users who authenticate using their E-Mail address or username in Anti-CSRF-Tokens. Craft CMS uses a cookie called CRAFTCSRFTOKEN and a HTML hidden field called CRAFTCSRFTOKEN to avoid Cross Site Request Forgery attacks. T...
CVE-2022-37783
Craft CMS versions 3.0.0–3.7.32 disclose user password hashes via the CRAFT_CSRF_TOKEN cookie and corresponding HTML field; the hash can be decoded using Yii public functions. Impact is password hash disclosure (confidentiality). No explicit exploit details or fixed versions are provided in the c...
CVE-2022-37783
All Craft CMS versions between 3.0.0 and 3.7.32 disclose password hashes of users who authenticate using their E-Mail address or username in Anti-CSRF-Tokens. Craft CMS uses a cookie called CRAFTCSRFTOKEN and a HTML hidden field called CRAFTCSRFTOKEN to avoid Cross Site Request Forgery attacks. T...
Pixel＆tonic Craft CMS 安全漏洞
Pixel & tonic Craft CMS is a content management system CMS from the US-based Pixel & tonic, Inc. A security vulnerability exists in Pixel & tonic Craft CMS versions 3.0.0 through 3.7.32, which originates from exposing password hashes of users who authenticate using email addresses or usernames in...
CVE-2022-37783
All Craft CMS versions between 3.0.0 and 3.7.32 disclose password hashes of users who authenticate using their E-Mail address or username in Anti-CSRF-Tokens. Craft CMS uses a cookie called CRAFTCSRFTOKEN and a HTML hidden field called CRAFTCSRFTOKEN to avoid Cross Site Request Forgery attacks. T...
Craft CMS Command Injection (CVE-2020-9757)
A Command Injection vulnerability exists in Craft CMS. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...
GHSA-F546-V666-559X Craft CMS Cross-site Scripting vulnerability
Craft CMS 4.2.0.1 is affected by Cross Site Scripting XSS in the file src/web/assets/cp/src/js/BaseElementSelectInput.js and in specific on the line label: elementInfo.label...
Craft CMS Cross-site Scripting vulnerability
Craft CMS 4.2.0.1 is affected by Cross Site Scripting XSS in the file src/web/assets/cp/src/js/BaseElementSelectInput.js and in specific on the line label: elementInfo.label...
CVE-2022-37246
Craft CMS 4.2.0.1 is affected by Cross Site Scripting XSS in the file src/web/assets/cp/src/js/BaseElementSelectInput.js and in specific on the line label: elementInfo.label...
Cross site scripting
Craft CMS 4.2.0.1 is affected by Cross Site Scripting XSS in the file src/web/assets/cp/src/js/BaseElementSelectInput.js and in specific on the line label: elementInfo.label...