1391 matches found
CVE-2022-23409
The Logs plugin before 3.0.4 for Craft CMS allows remote attackers to read arbitrary files via input to actionStream in Controller.php...
Pixel＆tonic Craft CMS 路径遍历漏洞
Pixel & tonic Craft CMS is a content management system CMS from Pixel & Tonic Pixel & tonic. A path traversal vulnerability exists in Pixel & tonic Craft CMS, which stems from a path traversal security issue in the Ethercreative Logs plugin for Craft CMS...
Ethercreative Logs 3.0.3 Path Traversal Vulnerability
======================================================================= title: Authenticated Path Traversal product: Ethercreative Logs plugin for Craft CMS vulnerable version: =3.0.4 CVE number: CVE-2022-23409 impact: Medium homepage: https://github.com/ethercreative/logs found: 2021-07-06 by:...
Ethercreative Logs 3.0.3 Path Traversal
SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Authenticated Path Traversal product: Ethercreative Logs plugin for Craft CMS vulnerable version: =3.0.4 CVE number: CVE-2022-23409 impact: Medium homepage:...
GHSA-XRPJ-F9V6-2332 CSV injection in Craft CMS
Withdrawn Duplicate of GHSA-h7vq-5qgw-jwwq...
CSV injection in Craft CMS
Withdrawn Duplicate of GHSA-h7vq-5qgw-jwwq...
CVE-2021-41824
Craft CMS before 3.7.14 allows CSV injection...
CVE-2021-41824
Craft CMS before 3.7.14 allows CSV injection...
Design/Logic Flaw
Craft CMS before 3.7.14 allows CSV injection...
CVE-2021-41824
Craft CMS before 3.7.14 allows CSV injection...
CVE-2021-41824
Craft CMS before version 3.7.14 is vulnerable to CSV injection via export functionality. The root cause is lack of input sanitization/escaping when exporting data to CSV, allowing crafted input to trigger payloads in CSV readers (e.g., Excel). Affected software is Craft CMS (core) with CSV export...
CVE-2021-41824
Craft CMS before 3.7.14 allows CSV injection...
Craft CMS Remote Code Injection
An issue was discovered in Craft CMS before 3.6.7. In some circumstances, a potential Remote Code Execution vulnerability existed on sites that did not restrict administrative changes if an attacker were somehow able to hijack an administrator's session...
GHSA-X2J7-6HXM-87P3 Craft CMS Remote Code Injection
An issue was discovered in Craft CMS before 3.6.7. In some circumstances, a potential Remote Code Execution vulnerability existed on sites that did not restrict administrative changes if an attacker were somehow able to hijack an administrator's session...
Craft CMS Cross-site Scripting Vulnerability
An issue was discovered in Craft CMS before 3.6.0. In some circumstances, a potential XSS vulnerability existed in connection with front-end forms that accepted user uploads...
GHSA-3JXH-789F-P7M6 Craft CMS Cross-site Scripting Vulnerability
An issue was discovered in Craft CMS before 3.6.0. In some circumstances, a potential XSS vulnerability existed in connection with front-end forms that accepted user uploads...
Craft CMS Cross-Site Scripting Vulnerability (CNVD-2021-46873)
Craft CMS is a content management system for developers, designers and web professionals that provides flexibility, power and ease of use. A cross-site scripting vulnerability exists in a front-end form that accepts user uploads in versions of Craft CMS prior to 3.6.0. Detailed vulnerability...
Craft CMS Remote Code Execution Vulnerability
Craft CMS is a content management system for developers, designers and web professionals that provides flexibility, power and ease of use. A remote code execution vulnerability exists in Craft CMS versions prior to 3.6.7 without restricting administrator changes. An attacker can exploit this...