CVE-2020-19884

DBHcms v1.2.0 has a stored xss vulnerability as there is no htmlspecialchars function in dbhcms\mod\mod.domain.edit.php line 119...

CVE-2020-19883

CVE-2020-19883 affects DBHcms v1.2.0 with a stored cross-site scripting vulnerability due to a missing security filter in dbhcms/mod/mod.users.view.php line 57 (user_login). The vulnerability allows an authenticated admin to hijack other users, as described in multiple connected sources. Exploita...

CVE-2020-19883

DBHcms v1.2.0 has a stored xss vulnerability as there is no security filter in dbhcms\mod\mod.users.view.php line 57 for userlogin, A remote authenticated with admin user can exploit this vulnerability to hijack other users...

CVE-2020-19882

CVE-2020-19882 affects DBHcms v1.2.0. A stored XSS vulnerability exists due to missing htmlspecialchars handling for the ‘menu_description’ variable in the code paths dbhcms/mod/mod.menus.edit.php (line 83) and dbhcms/mod/mod.menus.view.php (line 111). The issue could allow a remote attacker auth...

CVE-2020-19882

DBHcms v1.2.0 has a stored xss vulnerability as there is no htmlspecialchars function for 'menudescription' variable in dbhcms\mod\mod.menus.edit.php line 83 and in dbhcms\mod\mod.menus.view.php line 111, A remote authenticated with admin user can exploit this vulnerability to hijack other users...

CVE-2020-19877

DBHcms v1.2.0 has a directory traversal vulnerability as there is no directory control function in directory /dbhcms/. A remote unauthenticated attacker can exploit this vulnerability to obtain server-sensitive information...

CVE-2020-19877

DBHcms v1.2.0 has a directory traversal vulnerability as there is no directory control function in directory /dbhcms/. A remote unauthenticated attacker can exploit this vulnerability to obtain server-sensitive information...

Directory traversal

DBHcms v1.2.0 has a directory traversal vulnerability as there is no directory control function in directory /dbhcms/. A remote unauthenticated attacker can exploit this vulnerability to obtain server-sensitive information...

CVE-2020-19881

DBHcms v1.2.0 contains a reflected XSS vulnerability due to lack of input filtering on the $_GET['return_name'] parameter in dbhcms/mod/mod.selector.php (line 108). A remote attacker authenticated as an admin can exploit this to hijack other users. Affected component: DBHcms 1.2.0; Root cause: mi...

CVE-2020-19881

DBHcms v1.2.0 has a reflected xss vulnerability as there is no security filter in dbhcms\mod\mod.selector.php line 108 for $GET'returnname' parameter, A remote authenticated with admin user can exploit this vulnerability to hijack other users...

CVE-2020-19880

DBHcms v1.2.0 has a stored xss vulnerability as there is no htmlspecialchars function form 'Name' in dbhcms\types.php, A remote unauthenticated attacker can exploit this vulnerability to hijack other users...

CVE-2020-19880

DBHcms v1.2.0 is affected by a stored XSS vulnerability due to the absence of htmlspecialchars protection for the Name field in dbhcms/types.php. This allows a remote unauthenticated attacker to hijack other users by injecting malicious input that is persisted and later rendered in other users’ s...

CVE-2020-19879

DBHcms v1.2.0 is vulnerable to a stored cross-site scripting (XSS) due to lack of input filtering on $_GET['dbhcms_pid'] in dbhcms\page.php (line 107). CVE-2020-19879 has CVSS v2 base 4.3 (NETWORK, MEDIUM) and CVSS v3.1 base 6.1 (NETWORK, MEDIUM) with user interaction required. Exploitation detai...

CVE-2020-19879

DBHcms v1.2.0 has a stored xss vulnerability as there is no security filter of $GET'dbhcmspid' variable in dbhcms\page.php line 107,...

CVE-2020-19878

DBHcms v1.2.0 has a sensitive information leaks vulnerability as there is no security access control in /dbhcms/ext/news/ext.news.be.php, A remote unauthenticated attacker can exploit this vulnerability to get path information...

CVE-2020-19878

CVE-2020-19878 affects DBHcms v1.2.0. The vulnerability is an information-disclosure due to missing security access control in the path /dbhcms/ext/news/ext.news.be.php, allowing a remote unauthenticated attacker to obtain path information. Connected sources corroborate the description across NVD...

CVE-2020-19877

DBHcms v1.2.0 has a directory traversal vulnerability as there is no directory control function in directory /dbhcms/. A remote unauthenticated attacker can exploit this vulnerability to obtain server-sensitive information...

CVE-2020-19877

DBHcms v1.2.0 is affected by a directory traversal vulnerability due to lack of directory access control in the /dbhcms/ directory. A remote unauthenticated attacker can obtain server‑sensitive information through this flaw. Root cause: absence of directory traversal protection in the application...

dbhcms 1.1.4 - Stored XSS

No description provided by source. Title: DBHcms 1.1.4 Stored XSS Vendor: http://www.drbenhur.com Dork: powered by DBHcms AUTHOR: ITSecTeam Email: [email protected] Website: http://www.itsecteam.com Forum : http://forum.ITSecTeam.com Original Advisory:...

DBHcms 1.1.4 (dbhcms_user and searchString) - SQL Injection Vulnerability

No description provided by source. Vulnerability ID: HTB22651 Reference: http://www.htbridge.ch/advisory/sqlinjectionindbhcms.html Product: DBHcms Vendor: drbenhur.com http://www.drbenhur.com/ Vulnerable Version: 1.1.4 and probably prior versions Vendor Notification: 13 October 2010 Vulnerability...