52 matches found
CVE-2020-20726
CVE-2020-20726 affects Gila GilaCMS v1.11.4. The vulnerability is Cross-Site Request Forgery in the cm/update_rows/user parameter, allowing a remote attacker to execute arbitrary code. Root cause described as lack of validation in that parameter. Impact is high (C, I, A all High) per CVSS 3.1 met...
CVE-2020-20726
Cross Site Request Forgery vulnerability in Gila GilaCMS v.1.11.4 allows a remote attacker to execute arbitrary code via the cm/updaterows/user parameter...
CVE-2020-20726
Cross Site Request Forgery vulnerability in Gila GilaCMS v.1.11.4 allows a remote attacker to execute arbitrary code via the cm/updaterows/user parameter...
GHSA-HWQC-PGJW-VJQP Cross-Site Request Forgery in GilaCMS
A Cross-Site Request Forgery CSRF in GilaCMS v1.11.4 allows authenticated attackers to arbitrarily add administrator accounts...
Cross-Site Request Forgery in GilaCMS
A Cross-Site Request Forgery CSRF in GilaCMS v1.11.4 allows authenticated attackers to arbitrarily add administrator accounts...
GHSA-H7MQ-27R7-W972 Cross-site Scripting in GilaCMS
A cross-site scripting XSS vulnerability in /admin/content/post of GilaCMS v1.11.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the Tags field...
Cross-site Scripting in GilaCMS
A cross-site scripting XSS vulnerability in /admin/content/post of GilaCMS v1.11.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the Tags field...
GHSA-6675-WWQR-JHMF Cross-site Scripting in GilaCMS
A stored cross-site scripting XSS vulnerability in GilaCMS v1.11.4 allows attackers to execute arbitrary web scripts or HTML via a crafted SVG file...
Cross-site Scripting in GilaCMS
A stored cross-site scripting XSS vulnerability in GilaCMS v1.11.4 allows attackers to execute arbitrary web scripts or HTML via a crafted SVG file...
CVE-2020-20692
GilaCMS v1.11.4 was discovered to contain a SQL injection vulnerability via the $GET parameter in /src/core/controllers/cm.php...
CVE-2020-20693
A Cross-Site Request Forgery CSRF in GilaCMS v1.11.4 allows authenticated attackers to arbitrarily add administrator accounts...
CVE-2020-20695
A stored cross-site scripting XSS vulnerability in GilaCMS v1.11.4 allows attackers to execute arbitrary web scripts or HTML via a crafted SVG file...
CVE-2020-20692
GilaCMS v1.11.4 was discovered to contain a SQL injection vulnerability via the $GET parameter in /src/core/controllers/cm.php...
CVE-2020-20696
A cross-site scripting XSS vulnerability in /admin/content/post of GilaCMS v1.11.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the Tags field...
Sql injection
GilaCMS v1.11.4 was discovered to contain a SQL injection vulnerability via the $GET parameter in /src/core/controllers/cm.php...
Cross site scripting
A cross-site scripting XSS vulnerability in /admin/content/post of GilaCMS v1.11.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the Tags field...
Cross site request forgery (csrf)
A Cross-Site Request Forgery CSRF in GilaCMS v1.11.4 allows authenticated attackers to arbitrarily add administrator accounts...
Cross site scripting
A stored cross-site scripting XSS vulnerability in GilaCMS v1.11.4 allows attackers to execute arbitrary web scripts or HTML via a crafted SVG file...
CVE-2020-20693
CVE-2020-20693 describes a Cross-Site Request Forgery (CSRF) in GilaCMS v1.11.4 that allows authenticated attackers to arbitrarily add administrator accounts. The vulnerability is documented across multiple feeds (NVD entry CVE-2020-20693, RH Red Hat advisory, GHSA advisory, CNVD/CNNVD) and is as...