1992 matches found
CVE-2019-9554
Craft CMS 3.1.12 Pro contains a Cross-site Scripting (XSS) vulnerability in the header insertion field used when adding source code at the s/admin/entries/news/new URI. The issue is triggered by input in the header insertion field and is described as a stored XSS, potentially allowing an attacker...
PT-2019-19705
Name of the Vulnerable Software and Affected Versions Craft CMS version 3.1.12 Description A cross-site scripting XSS issue has been found in the header insertion field when adding source code at the "/s/admin/entries/news/new" API endpoint. Recommendations For Craft CMS version 3.1.12, update to...
CVE-2019-9554: Improper Neutralization of Input During Web Page Generation
In the 3.1.12 Pro version of Craft CMS, XSS has been discovered in the header insertion field when adding source code at an s/admin/entries/news/new URI...
Craft CMS Rate Limiting / Brute Force
Exploit Title : Craft CMS up to 3.1.7 Password Prompt Form Lockout weak authentication Author Discovered By : Mohammed Abdul Raheem Author's Company Name : TrekShield IT Solution Private Limited Author Exploit-db : https://www.exploit-db.com/?author=9783 Found Vulnerability On : 16-01-2019 Vendor...
Craft CMS Authorization Issues Vulnerability
Craft CMS is a content management system CMS. An authorization issue vulnerability exists in Craft CMS 3.1.7 and earlier versions, which can be exploited by attackers to conduct brute force attacks...
CVE-2019-15929
In Craft CMS through 3.1.7, the elevated session password prompt was not being rate limited like normal login forms, leading to the possibility of a brute force attempt on them...
CVE-2019-15929
In Craft CMS through 3.1.7, the elevated session password prompt was not being rate limited like normal login forms, leading to the possibility of a brute force attempt on them...
Sql injection
In Craft CMS through 3.1.7, the elevated session password prompt was not being rate limited like normal login forms, leading to the possibility of a brute force attempt on them...
CVE-2019-15929
In Craft CMS through 3.1.7, the elevated session password prompt was not being rate limited like normal login forms, leading to the possibility of a brute force attempt on them...
CVE-2019-15929
In Craft CMS through 3.1.7, the elevated session password prompt was not being rate limited like normal login forms, leading to the possibility of a brute force attempt on them...
CVE-2019-15929
Craft CMS up to version 3.1.7 is affected by an authentication issue where the elevated session password prompt was not rate-limited, enabling brute-force attempts as described across multiple sources. The vulnerability affects the login flow for elevated sessions and is documented in CVE-2019-15...
PT-2019-14474
Name of the Vulnerable Software and Affected Versions Craft CMS versions prior to 3.1.7 Description The elevated session password prompt in Craft CMS was not rate limited, similar to normal login forms, allowing for potential brute force attempts. Recommendations For versions prior to 3.1.7, upda...
CVE-2019-15929: Weak Password Recovery Mechanism for Forgotten Password
In Craft CMS through 3.1.7, the elevated session password prompt was not being rate limited like normal login forms, leading to the possibility of a brute force attempt on them...
Craft CMS Cross-Site Scripting Vulnerability (CNVD-2019-35848)
Craft CMS is a content management system CMS. A cross-site scripting vulnerability exists in Craft CMS versions prior to 3.3.8 that can be exploited by an attacker to execute client-side code...
Cross-Site Scripting (XSS)
Craft CMS is vulnerable to cross-site scripting XSS attack. The attack is possible because the name attribute in site deletion is not properly validated, allowing an attacker to inject arbitrary script through it...
CVE-2019-17496
Craft CMS before 3.3.8 has stored XSS via a name field. This field is mishandled during site deletion...
CVE-2019-17496
Craft CMS before 3.3.8 has stored XSS via a name field. This field is mishandled during site deletion...
Arbitrary file deletion
Craft CMS before 3.3.8 has stored XSS via a name field. This field is mishandled during site deletion...
CVE-2019-17496
Craft CMS prior to 3.3.8 is affected by a stored XSS in the site deletion flow where the name field is mishandled. The issue enables injection through the name field and is limited to Craft CMS versions before 3.3.8; upgrading to 3.3.8 or later is the documented remediation. The CVE description a...