CVE-2020-19150

Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive information or cause a denial of service via the 'FileManager.delete' function in the component 'modules/filemanager/FileManagerController.java'...

CVE-2020-19147

Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive infromation via the 'getFolder' function in the component '/modules/filemanager/FileManager.java'...

PT-2021-10292

Name of the Vulnerable Software and Affected Versions: Jfinal CMS versions 4.7.1 and earlier Description: The issue allows remote attackers to obtain sensitive information or cause a denial of service. This is achieved via the FileManager.delete function in the component...

PT-2021-10293

Name of the Vulnerable Software and Affected Versions: Jfinal CMS versions 4.7.1 and earlier Description: The issue allows remote attackers to execute arbitrary code by uploading a malicious HTML template file via the component 'jfinal cms/admin/filemanager/list'. Recommendations: For Jfinal CMS...

Jfinal CMS path traversal vulnerability

Jfinal CMS is a powerful information consulting website developed in java, using JFinal as the web framework, template engine with beetl, database with mysql, front-end bootstrap framework. jfinal CMS 4.7.1 and earlier versions have improper access control vulnerabilities. An attacker could use t...

PT-2021-10290

Name of the Vulnerable Software and Affected Versions: Jfinal CMS versions 4.7.1 and earlier Description: The issue allows remote attackers to obtain sensitive information due to improper access control. This is achieved via the getFolder function in the component...

CVE-2020-19151: Improper Neutralization of Special Elements used in a Command

Command Injection in Jfinal CMS v4.7.1 and earlier allows remote attackers to execute arbitrary code by uploading a malicious HTML template file via the component 'jfinalcms/admin/filemanager/list'...

CVE-2020-19154: Improper Limitation of a Pathname to a Restricted Directory

Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive information via the 'FileManager.editFile' function in the component 'modules/filemanager/FileManagerController.java'...

CVE-2020-20642

Cross Site Request Forgery CSRF vulnerability exists in EyouCMS 1.3.6 that can add an htm page to execute the js code via login.php?m=admin&c=Filemanager&a=newfile&lang=cn...

CVE-2020-20642

Cross Site Request Forgery CSRF vulnerability exists in EyouCMS 1.3.6 that can add an htm page to execute the js code via login.php?m=admin&c=Filemanager&a=newfile&lang=cn...

CVE-2020-20642

Cross Site Request Forgery CSRF vulnerability exists in EyouCMS 1.3.6 that can add an htm page to execute the js code via login.php?m=admin&c=Filemanager&a=newfile&lang=cn...

CVE-2020-20642

CVE-2020-20642: CSRF vulnerability in EyouCMS 1.3.6 allows adding an HTML page to execute JavaScript via login.php?m=admin&c=Filemanager&a=newfile&lang=cn. Affected product is EyouCMS (ThinkPHP-based). Root cause: cross-site request forgery enabling unauthorized page creation; exact exploit path ...

PT-2021-10519

Name of the Vulnerable Software and Affected Versions: EyouCMS version 1.3.6 Description: A Cross Site Request Forgery CSRF issue exists, allowing an attacker to add an htm page that can execute js code via the login.php endpoint with specific parameters: m=admin, c=Filemanager, a=newfile, and...

CVE-2020-20642: Cross-Site Request Forgery (CSRF)

Cross Site Request Forgery CSRF vulnerability exists in EyouCMS 1.3.6 that can add an htm page to execute the js code via login.php?m=admin&c=Filemanager&a=newfile&lang=cn...

Tecnick.com TCExam Cross-Site Script Vulnerabilities

Tecnick.com TCExam is a Web-based open source e-exam system from Tecnick.com, UK. The system is primarily used for online exams, among other things. A security vulnerability exists in Tecnick.com TCExam, which stems from a reflected cross-site scripting vulnerability in TCExam prior to version...

Tecnick.com TCExam Cross-Site Script Vulnerabilities

Tecnick.com TCExam is a Web-based open source e-exam system from Tecnick.com, UK. The system is primarily used for online exams, among other things. A security vulnerability exists in Tecnick.com TCExam, which stems from a reflected cross-site scripting vulnerability in TCExam prior to version...

CVE-2021-20111

A stored cross-site scripting vulnerability exists in TCExam = 14.8.1. Valid files uploaded via tcefilemanager.php with a filename beggining with a period will be rendered as text/html. An attacker with access to tcefilemanager.php could upload a malicious javascript payload which would be...

Tecnick.com TCExam Cross-Site Script Vulnerabilities

Tecnick.com TCExam is a Web-based open source e-exam system from Tecnick.com, UK. The system is primarily used for online exams, among other things. TCExam suffers from a cross-site scripting vulnerability that originates. The vulnerability exists due to insufficient validation of user-supplied...

GHSA-QPGW-2C72-4C89 Mautic users able to download any files from server using filemanager

Impact Mautic versions 1.0.0 - 2.11.0 are vulnerable to allowing any authorized Mautic user session must be logged into Mautic to use the Filemanager to download any file from the server that the web user has access to. Patches Update to 2.12.0 or later. Workarounds None For more information If y...

Mautic users able to download any files from server using filemanager

Impact Mautic versions 1.0.0 - 2.11.0 are vulnerable to allowing any authorized Mautic user session must be logged into Mautic to use the Filemanager to download any file from the server that the web user has access to. Patches Update to 2.12.0 or later. Workarounds None For more information If y...