4 matches found
PT-2019-12764
Name of the Vulnerable Software and Affected Versions EmpireCMS version 7.5.0 Description The issue allows for XSS via the HTTP Referer header to the "e/member/doaction.php" endpoint. Recommendations For EmpireCMS version 7.5.0, update to a version that fixes this issue, or as a temporary...
PT-2019-12763
Name of the Vulnerable Software and Affected Versions EmpireCMS version 7.5.0 Description The issue allows for XSS via the from parameter to "e/member/doaction.php". This can be exploited using a CSRF payload to change the dynamic page template. An attacker can resend the...
CVE-2019-12361: Improper Neutralization of Input During Web Page Generation
EmpireCMS 7.5.0 has XSS via the from parameter to e/member/doaction.php, as demonstrated by a CSRF payload that changes the dynamic page template. The attacker can choose to resend the e/template/member/regsend.php registered activation mail page...