PT-2021-24182

Name of the Vulnerable Software and Affected Versions: glFusion CMS version 1.7.9 Description: The issue allows for arbitrary user registration, where an attacker can register using the mailbox of any existing user. This can lead to a situation where legitimate users find their mailbox already...

PT-2021-24185 · Unknown · Glfusion Cms

Name of the Vulnerable Software and Affected Versions: glFusion CMS version 1.7.9 Description: The issue is related to an access control vulnerability. It can be exploited via the "/public html/users.php" API endpoint. Recommendations: For glFusion CMS version 1.7.9, update to a version that fixe...

CVE-2021-44949: Authorization Bypass Through User-Controlled Key

glFusion CMS 1.7.9 is affected by an access control vulnerability via /publichtml/users.php...

PT-2021-24183

Name of the Vulnerable Software and Affected Versions: glFusion CMS version 1.7.9 Description: The issue concerns a Cross Site Request Forgery CSRF vulnerability. This vulnerability is located in the "/public html/admin/plugins/bad behavior2/blacklist.php" endpoint. An attacker can exploit this...

PT-2021-24184

Name of the Vulnerable Software and Affected Versions: glFusion CMS version 1.7.9 Description: The issue is related to a Cross Site Request Forgery CSRF vulnerability. This vulnerability is located in the /public html/admin/plugins/bad behavior2/blacklist.php endpoint. An attacker can exploit thi...

GlFusion Cms 授权问题漏洞

glFusion CMS is a content management and publishing system. glFusion CMS v1.7.9 is vulnerable to arbitrary user registration, which can be exploited by attackers to register using any user's email address...

glfusion cms 1.2.1 - Stored XSS via img tag

No description provided by source. Exploit Title: glfusion CMS 1.2.1 stored XSS via img tag Date: 14-1-2010 Author: Saif El-Sherei Software Link: www.glfusion.org/filemgmt/viewcat.php?cid=1http://php.opensourcecms.com/scripts/redirect/download.php?id=33 Version: 1.2.1 Tested on: Firefox 3.0.15...

glFusion 1.2.2 - Multiple XSS Vulnerabilities

No description provided by source...

glFusion 1.1 Anonymous Comment 'username' Field HTML Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/33683/info glFusion is prone to an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied data. Attacker-supplied HTML or JavaScript code could run in the context of the affected site,...

glFusion <= 1.1.2 COM_applyFilter()/cookies Blind SQL Injection Exploit

No description provided by source. ?php / glFusion = 1.1.2 COMapplyFilter/cookies remote blind sql injection exploit by Nine:Situations:Group::bookoo our site: http://retrogod.altervista.org/ software site: http://www.glfusion.org/ google dork: Page created in seconds by glFusion +RSS Found anoth...

glFusion 1.3.0 (search.php, cat_id param) - SQL Injection

No description provided by source...

glFusion <= 1.1.2 COM_applyFilter()/order SQL Injection Exploit

No description provided by source. ?php / glFusion = 1.1.2 COMapplyFilter/order sql injection exploit by Nine:Situations:Group::bookoo working against Mysql = 4.1 php.ini independent our site: http://retrogod.altervista.org/ software site: http://www.glfusion.org/ google dork: Page created in...

CVE-2013-1466

Multiple cross-site scripting XSS vulnerabilities in glFusion before 1.2.2.pl4 allow remote attackers to inject arbitrary web script or HTML via the 1 subject parameter to profiles.php; 2 address1, 3 address2, 4 calendartype, 5 city, 6 state, 7 title, 8 url, or 9 zipcode parameter to...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in glFusion before 1.2.2.pl4 allow remote attackers to inject arbitrary web script or HTML via the 1 subject parameter to profiles.php; 2 address1, 3 address2, 4 calendartype, 5 city, 6 state, 7 title, 8 url, or 9 zipcode parameter to...

CVE-2013-1466

CVE-2013-1466 affects glFusion (CMS) prior to 1.2.2.pl4 with multiple cross-site scripting (XSS) vulnerabilities. The flaw allows remote attackers to inject arbitrary HTML/JavaScript via user-supplied fields in several pages: profiles.php (subject), calendar/index.php (address1, address2, calenda...

CVE-2013-1466

Multiple cross-site scripting XSS vulnerabilities in glFusion before 1.2.2.pl4 allow remote attackers to inject arbitrary web script or HTML via the 1 subject parameter to profiles.php; 2 address1, 3 address2, 4 calendartype, 5 city, 6 state, 7 title, 8 url, or 9 zipcode parameter to...

PT-2014-2480

Name of the Vulnerable Software and Affected Versions glFusion versions prior to 1.2.2.pl4 Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via various parameters, including subject in profiles.php, address1, address2, calendar type, city,...

CVE-2013-1466: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in glFusion before 1.2.2.pl4 allow remote attackers to inject arbitrary web script or HTML via the 1 subject parameter to profiles.php; 2 address1, 3 address2, 4 calendartype, 5 city, 6 state, 7 title, 8 url, or 9 zipcode parameter to...

glFusion 1.3.0 - search.php?cat_id SQL Injection

glFusion 1.3.0 - search.php?catid SQL Injection Information -------------------- Name : SQL Injection Vulnerability in glFusion Software : glFusion 1.3.0 and possibly below. Vendor Homepage : http://www.glfusion.org Vulnerability Type : Blind SQL Injection Severity : Critical Researcher : Omar Ku...

glFusion 1.3.0 - 'search.php?cat_id' SQL Injection

Information -------------------- Name : SQL Injection Vulnerability in glFusion Software : glFusion 1.3.0 and possibly below. Vendor Homepage : http://www.glfusion.org Vulnerability Type : Blind SQL Injection Severity : Critical Researcher : Omar Kurt Advisory Reference : NS-13-009 Description...