CVE-2018-19461

admin\db\DoSql.php in EmpireCMS through 7.5 allows XSS via crafted SQL syntax to admin/admin.php...

CVE-2018-19462

EmpireCMS up to version 7.5 is affected by CVE-2018-19462 due to a vulnerability in admin\db\DoSql.php. An attacker can remotely trigger SQL injection that uses a .php filename in a SELECT INTO OUTFILE statement targeting admin/admin.php, resulting in arbitrary PHP code execution on the server. T...

CVE-2018-19462

admin\db\DoSql.php in EmpireCMS through 7.5 allows remote attackers to execute arbitrary PHP code via SQL injection that uses a .php filename in a SELECT INTO OUTFILE statement to admin/admin.php...

Cross site request forgery (csrf)

EmpireCMS 7.5.0 has XSS via the from parameter to e/member/doaction.php, as demonstrated by a CSRF payload that changes the dynamic page template. The attacker can choose to resend the e/template/member/regsend.php registered activation mail page...

CVE-2019-12362

EmpireCMS 7.5.0 has XSS via the HTTP Referer header to e/member/doaction.php...

CVE-2019-12361

EmpireCMS 7.5.0 has XSS via the from parameter to e/member/doaction.php, as demonstrated by a CSRF payload that changes the dynamic page template. The attacker can choose to resend the e/template/member/regsend.php registered activation mail page...

CVE-2019-12362

EmpireCMS 7.5.0 has XSS via the HTTP Referer header to e/member/doaction.php...

Cross site scripting

EmpireCMS 7.5.0 has XSS via the HTTP Referer header to e/member/doaction.php...

CVE-2019-12361

EmpireCMS 7.5.0 has XSS via the from parameter to e/member/doaction.php, as demonstrated by a CSRF payload that changes the dynamic page template. The attacker can choose to resend the e/template/member/regsend.php registered activation mail page...

CVE-2019-12362

CVE-2019-12362 affects EmpireCMS 7.5.0. The vulnerability is an XSS flaw exploitable via the HTTP Referer header to the endpoint e/member/doaction.php, as documented across Red Hat, NVD, CVE lists and CNVD/CVELIST entries. The available sources identify a cross-site scripting risk in EmpireCMS 7....

CVE-2019-12362

EmpireCMS 7.5.0 has XSS via the HTTP Referer header to e/member/doaction.php...

CVE-2019-12361

EmpireCMS 7.5.0 is affected by an XSS flaw reachable via the from parameter to e/member/doaction.php. The issue is demonstrated using a CSRF payload that alters the dynamic page template, with the attacker able to trigger a registered activation mail page (e/template/member/regsend.php). This sum...

CVE-2019-12361

EmpireCMS 7.5.0 has XSS via the from parameter to e/member/doaction.php, as demonstrated by a CSRF payload that changes the dynamic page template. The attacker can choose to resend the e/template/member/regsend.php registered activation mail page...

EmpireCMS cross-site scripting vulnerability (CNVD-2019-16391)

EmpireCMS Empire Content Management System is an open source content management system CMS. A cross-site scripting vulnerability exists in EmpireCMS version 7.5.0, which can be exploited by an attacker to execute client-side code...

Code Execution Vulnerability in EmpireCMS

EmpireCMS is based on B/S structure, secure, stable and flexible website management system. EmpireCMS there are code execution vulnerabilities , attackers can exploit the vulnerability of remote code execution , access to server privileges...

EmpireCMS Cross-Site Request Forgery Vulnerability (CNVD-2019-07938)

EmpireCMS Empire Content Management System is an open source content management system CMS. A cross-site request forgery vulnerability exists in EmpireCMS version 7.5. A remote attacker can exploit this vulnerability to add user accounts...

CVE-2018-18449

EmpireCMS 7.5 allows CSRF for adding a user account via an enews=AddUser action to e/admin/user/ListUser.php, a similar issue to CVE-2018-16339...

CVE-2018-18449

EmpireCMS 7.5 allows CSRF for adding a user account via an enews=AddUser action to e/admin/user/ListUser.php, a similar issue to CVE-2018-16339...

Cross site request forgery (csrf)

EmpireCMS 7.5 allows CSRF for adding a user account via an enews=AddUser action to e/admin/user/ListUser.php, a similar issue to CVE-2018-16339...

CVE-2018-18449

EmpireCMS 7.5 is affected by a CSRF vulnerability that allows adding a user account via enews=AddUser on e/admin/user/ListUser.php (and related mentions in CVE records). The NVD entry for CVE-2018-18449 lists CVSS v2 base score 6.8 (MEDIUM) and CVSS v3 base score 8.8 (HIGH) with network attack ve...