CVE-2020-20695

A stored cross-site scripting XSS vulnerability in GilaCMS v1.11.4 allows attackers to execute arbitrary web scripts or HTML via a crafted SVG file...

CVE-2020-20696

A cross-site scripting XSS vulnerability in /admin/content/post of GilaCMS v1.11.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the Tags field...

CVE-2020-20695

GilaCMS v1.11.4 is affected by a stored XSS vulnerability in the SVG handling, allowing an attacker to execute arbitrary web scripts or HTML via a crafted SVG file. This CVE (CVE-2020-20695) is corroborated by multiple connected advisories and national/third-party vulnerability entries (e.g., GHS...

CVE-2020-20696

GilaCMS v1.11.4 contains a cross-site scripting (XSS) vulnerability in the /admin/content/post endpoint, exposed via a crafted payload in the Tags field. The issue is described as an XSS allowing execution of arbitrary web scripts or HTML, as stated in multiple connected sources referencing CVE-2...

CVE-2020-20692

CVE-2020-20692 affects GilaCMS v1.11.4 with a SQL injection via the $_GET parameter in /src/core/controllers/cm.php . Root cause: improper handling of user input enabling SQL injection. NVD metrics (CVSSv3.1) show base score 7.2 (HIGH), network attack, low complexity, privileges required: HIGH, n...

CVE-2020-20692

GilaCMS v1.11.4 was discovered to contain a SQL injection vulnerability via the $GET parameter in /src/core/controllers/cm.php...

Gila CMS 1.11.5 Cross Site Request Forgery / Cross Site Scripting Vulnerabilities

Exploit for perl platform in category web applications ===== Tempest Security Intelligence - ADV-07/2020 ========================== GilaCMS - Version 1.11.5 Author: Rodolfo Tavares Tempest Security Intelligence - Recife, Pernambuco - Brazil ===== Table of...

GilaCMS 1.11.5 Cross Site Request Forgery / Cross Site Scripting

===== Tempest Security Intelligence - ADV-07/2020 ========================== GilaCMS - Version 1.11.5 Author: Rodolfo Tavares Tempest Security Intelligence - Recife, Pernambuco - Brazil ===== Table of Contents================================================== Overview Detailed description Timelin...

Cross-site Scripting (XSS)

gilacms/gila is vulnerable to cross-site scripting XSS. The attack exists because the admin/content/postcategory id parameter is not sanitized properly for gpreviewtheme...

gilacms.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1148066 Security Researcher ELProfesor Helped patch 2786 vulnerabilities Received 8 Coordinated Disclosure badges Received 106 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting gilacms.com website an...

Gila CMS Local File Inclusion

Exploit Title: Authenticated Local File InclusionLFI in GilaCMS Google Dork: N/A Date: 04-08-2019 Exploit Author: Sainadh Jamalpur Vendor Homepage: https://github.com/GilaCMS/gila Software Link: https://github.com/GilaCMS/gila Version: 1.10.9 Tested on: XAMPP version 3.2.2 in Windows 10 64bit, CV...

Gila CMS 1.11.1 - Local File Inclusion

Gila CMS 1.11.1 - Local File Inclusion Exploit Title: Authenticated Local File InclusionLFI in GilaCMS Google Dork: N/A Date: 04-08-2019 Exploit Author: Sainadh Jamalpur Vendor Homepage: https://github.com/GilaCMS/gila Software Link: https://github.com/GilaCMS/gila Version: 1.10.9 Tested on: XAMP...