cve-2026-16219-croogo-lab

CVE-2026-16219：Croogo FileManager 防御性实验室 本仓库记录并安全地演示了 Croogo CMS 中编号为 CVE-2026-16219 的路径授权缺陷。它面向防御者、维护者、学生以及对自己拥有或获明确授权评估的系统进行测试的研究人员。 安全边界： 附带的 HTTP 概念验证仅接受字面回环地址 127.0.0.1，仅在固定的非 Web 目标目录 /tmp/croogo-cve-2026-16219/ 中写入一个生成的 .txt 标记文件，不跟随重定向，并且在没有明确实验室确认的情况下拒绝运行。它不包含可执行载荷，也没有远程目标模式。 状态快照...

CVE-2026-16219

A flaw has been found in Croogo CMS up to 4.0.7. This affects the function FileManager::isEditable of the file FileManager/src/Utility/FileManager.php of the component Admin File Manager. This manipulation causes path traversal. The attack can be initiated remotely. The exploit has been published...

EUVD-2026-45430

A flaw has been found in Croogo CMS up to 4.0.7. This affects the function FileManager::isEditable of the file FileManager/src/Utility/FileManager.php of the component Admin File Manager. This manipulation causes path traversal. The attack can be initiated remotely. The exploit has been published...

CVE-2026-16219

A flaw has been found in Croogo CMS up to 4.0.7. This affects the function FileManager::isEditable of the file FileManager/src/Utility/FileManager.php of the component Admin File Manager. This manipulation causes path traversal. The attack can be initiated remotely. The exploit has been published...

CVE-2026-16219

CVE-2026-16219 affects Croogo CMS versions up to 4.0.7. The vulnerability lies in the Admin File Manager component, specifically FileManager::isEditable in FileManager/src/Utility/FileManager.php, leading to path traversal. Exploitation can be performed remotely; a working exploit has been publis...

CVE-2024-42718

A path traversal vulnerability in Croogo CMS 4.0.7 allows remote attackers to read arbitrary files via a specially crafted path in the 'edit-file' parameter...

GHSA-G5P6-3J82-XFM4 Croogo CMS has a path traversal vulnerability

A path traversal vulnerability in Croogo CMS 4.0.7 allows remote attackers to read arbitrary files via a specially crafted path in the 'edit-file' parameter...

EUVD-2024-55362

Croogo CMS has a path traversal vulnerability...

CVE-2024-42718

A path traversal vulnerability in Croogo CMS 4.0.7 allows remote attackers to read arbitrary files via a specially crafted path in the 'edit-file' parameter...

CVE-2024-42718

CVE-2024-42718 affects Croogo CMS 4.0.7 and is a path-traversal vulnerability that allows remote attackers to read arbitrary files via a crafted value in the edit-file parameter. The issue is documented across multiple feeds (Red Hat, CIRCL, OSV, NVD, etc.) with the same description. The CVE entr...

CVE-2024-42718

A path traversal vulnerability in Croogo CMS 4.0.7 allows remote attackers to read arbitrary files via a specially crafted path in the 'edit-file' parameter...

CVE-2024-42718

A path traversal vulnerability in Croogo CMS 4.0.7 allows remote attackers to read arbitrary files via a specially crafted path in the 'edit-file' parameter...

Croogo Cross-Site Scripting Vulnerability

Croogo is a content management system CMS based on the CakePHP framework development . The system provides content type can be customized for Blog, Node, Page, content editing using WYSIWYG editor and other features. A cross-site scripting vulnerability exists in Page name in Croogo version...

Croogo CMS Cross-Site Scripting Vulnerability

Croogo CMS is a content management system. Croogo CMS suffers from a cross-site scripting vulnerability that can be exploited by remote attackers to construct malicious URIs and trick users into parsing them, which can be used to obtain sensitive cookies, hijack sessions, or perform malicious...

Croogo 2.0.0 - Multiple Persistent Cross-Site Scripting Vulnerabilities

------------------------ XSS 1 -------- POST parameters: - dataContacttitle ------------------------ input type="hidden"...

Croogo CMS 1.3.4 Cross Site Scripting

Title: ====== Croogo v1.3.4 CMS - Multiple Web Vulnerabilities Date: ===== 2012-04-28 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=533 VL-ID: ===== 533 Introduction: ============= A CakePHP powered Content Management System. Croogo is a free and open source content...

Croogo CMS 1.3.4 - Multiple HTML Injection Vulnerabilities

Croogo CMS 1.3.4 - Multiple HTML Injection Vulnerabilities source: https://www.securityfocus.com/bid/53287/info Croogo CMS is prone to multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input. Successful exploits will allow attacker-supplied HTML and scrip...

Croogo CMS 1.3.4 - Multiple HTML Injection Vulnerabilities

source: https://www.securityfocus.com/bid/53287/info Croogo CMS is prone to multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input. Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser,...

Croogo v1.3.4 CMS - Multiple Web Vulnerabilities

Document Title: =============== Croogo v1.3.4 CMS - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=533 Release Date: ============= 2012-04-28 Vulnerability Laboratory ID VL-ID: ==================================== 533 Produc...

Croogo v1.3.4 CMS - Multiple Web Vulnerabilities

Document Title: =============== Croogo v1.3.4 CMS - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=533 Release Date: ============= 2012-04-28 Vulnerability Laboratory ID VL-ID: ==================================== 533 Produc...