768 matches found
CVE-2021-39497
eyoucms 1.5.4 lacks sanitization of input data, allowing an attacker to inject a url to trigger blind SSRF via the saveRemote function...
CVE-2021-39496
Eyoucms 1.5.4 lacks sanitization of input data, allowing an attacker to inject malicious code into filename param to trigger Reflected XSS...
CVE-2021-39499
A Cross-site scripting XSS vulnerability in Users in Qiong ICP EyouCMS 1.5.4 allows remote attackers to inject arbitrary web script or HTML via the title parameter in bindemail function...
CVE-2021-39496
Eyoucms 1.5.4 lacks sanitization of input data, allowing an attacker to inject malicious code into filename param to trigger Reflected XSS...
CVE-2021-39499
A Cross-site scripting XSS vulnerability in Users in Qiong ICP EyouCMS 1.5.4 allows remote attackers to inject arbitrary web script or HTML via the title parameter in bindemail function...
CVE-2021-39497
eyoucms 1.5.4 lacks sanitization of input data, allowing an attacker to inject a url to trigger blind SSRF via the saveRemote function...
Cross site scripting
A Cross-site scripting XSS vulnerability in Users in Qiong ICP EyouCMS 1.5.4 allows remote attackers to inject arbitrary web script or HTML via the title parameter in bindemail function...
CVE-2021-39496
Eyoucms 1.5.4 lacks sanitization of input data, allowing an attacker to inject malicious code into filename param to trigger Reflected XSS...
CVE-2021-39497
eyoucms 1.5.4 lacks sanitization of input data, allowing an attacker to inject a url to trigger blind SSRF via the saveRemote function...
Server side request forgery (ssrf)
eyoucms 1.5.4 lacks sanitization of input data, allowing an attacker to inject a url to trigger blind SSRF via the saveRemote function...
Cross site scripting
Eyoucms 1.5.4 lacks sanitization of input data, allowing an attacker to inject malicious code into filename param to trigger Reflected XSS...
CVE-2021-39499
A Cross-site scripting XSS vulnerability in Users in Qiong ICP EyouCMS 1.5.4 allows remote attackers to inject arbitrary web script or HTML via the title parameter in bindemail function...
CVE-2021-39501
Affected software: EyouCMS 1.5.4. Vulnerability: Open Redirect via the Logout function. The connected template confirms an input/redirect flow that allows an attacker to redirect users to a malicious URL. Impact: Potential phishing or credential theft due to user redirection (as described in the ...
CVE-2021-39501
EyouCMS 1.5.4 is vulnerable to Open Redirect. An attacker can redirect a user to a malicious url via the Logout function...
CVE-2021-39500
CVE-2021-39500 (EyouCMS 1.5.4) is a directory traversal vulnerability caused by a lack of input validation in the parameters tpldir, filename, type, and nid, allowing an attacker to inject "../" to escape and write files to writable directories. Connected sources corroborate the issue across mult...
CVE-2021-39500
Eyoucms 1.5.4 is vulnerable to Directory Traversal. Due to a lack of input data sanitizaton in param tpldir, filename, type, nid an attacker can inject "../" to escape and write file to writeable directories...
CVE-2021-39499
CVE-2021-39499 describes a cross-site scripting (XSS) vulnerability in Qiong ICP EyouCMS 1.5.4. The issue is triggered by supplying a crafted value to the title parameter in the bind_email function, allowing remote attackers to inject arbitrary web script or HTML. The reports consistently identif...
CVE-2021-39499
A Cross-site scripting XSS vulnerability in Users in Qiong ICP EyouCMS 1.5.4 allows remote attackers to inject arbitrary web script or HTML via the title parameter in bindemail function...
CVE-2021-39497
The CVE-2021-39497 entry concerns EyouCMS 1.5.4 where input data is not properly sanitized, allowing an attacker to inject a URL to trigger a blind server-side request forgery (SSRF) via the saveRemote() function. Root cause: lack of validation on input data leading to SSRF. Documented in multipl...