1563 matches found
CVE-2020-9757
The SEOmatic component before 3.3.0 for Craft CMS allows Server-Side Template Injection that leads to RCE via malformed data to the metacontainers controller...
CVE-2020-9757
Craft CMS SEOmatic component before 3.3.0 is vulnerable to Server-Side Template Injection that can lead to remote code execution via malformed data submitted to the metacontainers controller. The CVE-2020-9757 entry is corroborated by multiple connected documents (Nuclei template, Red Hat advisor...
CVE-2020-9757
The SEOmatic component before 3.3.0 for Craft CMS allows Server-Side Template Injection that leads to RCE via malformed data to the metacontainers controller...
CVE-2019-9554
In the 3.1.12 Pro version of Craft CMS, XSS has been discovered in the header insertion field when adding source code at an s/admin/entries/news/new URI...
CVE-2019-9554
In the 3.1.12 Pro version of Craft CMS, XSS has been discovered in the header insertion field when adding source code at an s/admin/entries/news/new URI...
Code injection
In the 3.1.12 Pro version of Craft CMS, XSS has been discovered in the header insertion field when adding source code at an s/admin/entries/news/new URI...
CVE-2019-9554
Craft CMS 3.1.12 Pro contains a Cross-site Scripting (XSS) vulnerability in the header insertion field used when adding source code at the s/admin/entries/news/new URI. The issue is triggered by input in the header insertion field and is described as a stored XSS, potentially allowing an attacker...
CVE-2019-9554
In the 3.1.12 Pro version of Craft CMS, XSS has been discovered in the header insertion field when adding source code at an s/admin/entries/news/new URI...
Craft CMS Rate Limiting / Brute Force
Exploit Title : Craft CMS up to 3.1.7 Password Prompt Form Lockout weak authentication Author Discovered By : Mohammed Abdul Raheem Author's Company Name : TrekShield IT Solution Private Limited Author Exploit-db : https://www.exploit-db.com/?author=9783 Found Vulnerability On : 16-01-2019 Vendor...
Craft CMS Authorization Issues Vulnerability
Craft CMS is a content management system CMS. An authorization issue vulnerability exists in Craft CMS 3.1.7 and earlier versions, which can be exploited by attackers to conduct brute force attacks...
CVE-2019-15929
In Craft CMS through 3.1.7, the elevated session password prompt was not being rate limited like normal login forms, leading to the possibility of a brute force attempt on them...
CVE-2019-15929
In Craft CMS through 3.1.7, the elevated session password prompt was not being rate limited like normal login forms, leading to the possibility of a brute force attempt on them...
Sql injection
In Craft CMS through 3.1.7, the elevated session password prompt was not being rate limited like normal login forms, leading to the possibility of a brute force attempt on them...
CVE-2019-15929
In Craft CMS through 3.1.7, the elevated session password prompt was not being rate limited like normal login forms, leading to the possibility of a brute force attempt on them...
CVE-2019-15929
Craft CMS up to version 3.1.7 is affected by an authentication issue where the elevated session password prompt was not rate-limited, enabling brute-force attempts as described across multiple sources. The vulnerability affects the login flow for elevated sessions and is documented in CVE-2019-15...
Craft CMS Cross-Site Scripting Vulnerability (CNVD-2019-35848)
Craft CMS is a content management system CMS. A cross-site scripting vulnerability exists in Craft CMS versions prior to 3.3.8 that can be exploited by an attacker to execute client-side code...
Cross-Site Scripting (XSS)
Craft CMS is vulnerable to cross-site scripting XSS attack. The attack is possible because the name attribute in site deletion is not properly validated, allowing an attacker to inject arbitrary script through it...
CVE-2019-17496
Craft CMS before 3.3.8 has stored XSS via a name field. This field is mishandled during site deletion...