122 matches found
Design/Logic Flaw
The removeXSS function in App/Common/common.php called from App/Modules/Index/Action/SearchAction.class.php in EasyCMS v1.4 allows XSS via an onhashchange event...
CVE-2018-16759
The removeXSS function in App/Common/common.php called from App/Modules/Index/Action/SearchAction.class.php in EasyCMS v1.4 allows XSS via an onhashchange event...
CVE-2018-16759
The removeXSS function in App/Common/common.php called from App/Modules/Index/Action/SearchAction.class.php in EasyCMS v1.4 allows XSS via an onhashchange event...
CVE-2018-16759
The removeXSS function in App/Common/common.php called from App/Modules/Index/Action/SearchAction.class.php in EasyCMS v1.4 allows XSS via an onhashchange event...
CVE-2018-16759
The CVE-2018-16759 entry concerns EasyCMS v1.4. The vulnerability is in the removeXSS function (App/Common/common.php), invoked by App/Modules/Index/Action/SearchAction.class.php, which allows cross-site scripting via an onhashchange event. The issue is concretely described across multiple source...
CVE-2018-16759: Improper Neutralization of Input During Web Page Generation
The removeXSS function in App/Common/common.php called from App/Modules/Index/Action/SearchAction.class.php in EasyCMS v1.4 allows XSS via an onhashchange event...
EasyCMS Cross-Site Request Forgery Vulnerability
EasyCMS is a scalable lightweight open source content management system CMS written in PHP. Cross-site request forgery vulnerability exists in EasyCMS version 1.5, which can be exploited by remote attackers to add a regular user and update the administrator password with the help of...
CVE-2018-16345
An issue was discovered in EasyCMS 1.5. There is a CSRF vulnerability that can update the admin password via index.php?s=/admin/rbacuser/update/navTabId/listusers/callbackType/closeCurrent...
CVE-2018-16345
An issue was discovered in EasyCMS 1.5. There is a CSRF vulnerability that can update the admin password via index.php?s=/admin/rbacuser/update/navTabId/listusers/callbackType/closeCurrent...
Cross site request forgery (csrf)
An issue was discovered in EasyCMS 1.5. There is a CSRF vulnerability that can update the admin password via index.php?s=/admin/rbacuser/update/navTabId/listusers/callbackType/closeCurrent...
CVE-2018-16345
An issue was discovered in EasyCMS 1.5. There is a CSRF vulnerability that can update the admin password via index.php?s=/admin/rbacuser/update/navTabId/listusers/callbackType/closeCurrent...
CVE-2018-16345
Affected software: EasyCMS 1.5. Vulnerability: Cross-Site Request Forgery (CSRF) allows updating the administrator password via index.php?s=/admin/rbacuser/update/navTabId/listusers/callbackType/closeCurrent. Root cause: insufficient CSRF protection on the admin-update endpoint. Impact: unauthori...
CVE-2018-16345: Cross-Site Request Forgery (CSRF)
An issue was discovered in EasyCMS 1.5. There is a CSRF vulnerability that can update the admin password via index.php?s=/admin/rbacuser/update/navTabId/listusers/callbackType/closeCurrent...
Cross site request forgery (csrf)
EasyCMS 1.3 has CSRF via the index.php?s=/admin/user/delAll URI to delete users...
CVE-2018-12971
EasyCMS 1.3 has CSRF via the index.php?s=/admin/user/delAll URI to delete users...
CVE-2018-12971
EasyCMS 1.3 has CSRF via the index.php?s=/admin/user/delAll URI to delete users...
CVE-2018-12971
EasyCMS 1.3 has CSRF via the index.php?s=/admin/user/delAll URI to delete users...
CVE-2018-12971
EasyCMS 1.3 is affected by a CSRF vulnerability that allows deleting users via the index.php?s=/admin/user/delAll URI. Multiple sources (NVD/NVD-derived entries, CVE lists, CNVD) corroborate that this is a CSRF flaw targeting the admin user deletion endpoint. The exact impact is deletion of users...
EasyCMS Cross-Site Request Forgery Vulnerability
EasyCMS is a scalable lightweight open source content management system CMS written in PHP. A cross-site request forgery vulnerability exists in EasyCMS version 1.3. A remote attacker can exploit this vulnerability to delete users with the help of index.php?s=/admin/user/delAll URI...