406 matches found
iCMS Cross-Site Request Forgery Vulnerability
iCMS is a content management system CMS built with PHP and MySQL databases. A cross-site request forgery vulnerability exists in iCMS version 7.0.9, which can be exploited by remote attackers with the help of the admincp.php?app=article&do=update page to make administrators review and approve any...
idreamsoft iCMS Cross-Site Request Forgery Vulnerability (CNVD-2018-19090)
idreamsoft iCMS is an open source content management system CMS based on PHP and MySQL. A cross-site request forgery vulnerability exists in the admincp.php file in version 7.0.11 of idreamsoft iCMS. The vulnerability stems from the detection of CSRFTOKEN when it does not exist, and the program...
idreamsoft iCMS Cross-Site Request Forgery Vulnerability (CNVD-2019-10136)
idreamsoft iCMS is an open source content management system CMS based on PHP and MySQL. A cross-site request forgery vulnerability exists in idreamsoft iCMS version 7.0.10, which can be exploited by remote attackers to add an administrator account with the help of admincp.php?app=user&do=save...
CVE-2018-16366
An issue was discovered in idreamsoft iCMS V7.0.10. admincp.php?app=user&do=save allows CSRF...
CVE-2018-16366
An issue was discovered in idreamsoft iCMS V7.0.10. admincp.php?app=user&do=save allows CSRF...
Cross site request forgery (csrf)
An issue was discovered in idreamsoft iCMS V7.0.10. admincp.php?app=group&do=save allows CSRF...
CVE-2018-16365
An issue was discovered in idreamsoft iCMS V7.0.10. admincp.php?app=group&do=save allows CSRF...
Cross site request forgery (csrf)
An issue was discovered in idreamsoft iCMS V7.0.10. admincp.php?app=user&do=save allows CSRF...
CVE-2018-16366
CVE-2018-16366 affects idreamsoft iCMS v7.0.10. The connected documents confirm a Cross-Site Request Forgery (CSRF) in admincp.php?app=user&do=save, enabling an attacker to perform privileged actions. One CNVD record notes an exploit path where a remote attacker could add an administrator account...
CVE-2018-16366
An issue was discovered in idreamsoft iCMS V7.0.10. admincp.php?app=user&do=save allows CSRF...
CVE-2018-16365
CVE-2018-16365 : In idreamsoft iCMS v7.0.10, the admincp.php?app=group&do=save endpoint is vulnerable to Cross-Site Request Forgery (CSRF). The CNVD entry notes this CSRF can be exploited to add an administrator account, indicating a real impact vector affecting CMS login/privilege management. Af...
CVE-2018-16332
An issue was discovered in iCMS 7.0.9. There is an admincp.php?app=article&do=update CSRF vulnerability...
Cross site request forgery (csrf)
An issue was discovered in iCMS 7.0.9. There is an admincp.php?app=article&do=update CSRF vulnerability...
CVE-2018-16332
An issue was discovered in iCMS 7.0.9. There is an admincp.php?app=article&do=update CSRF vulnerability...
CVE-2018-16332
An issue was discovered in iCMS 7.0.9. There is an admincp.php?app=article&do=update CSRF vulnerability...
CVE-2018-16332
CVE-2018-16332 affects iCMS 7.0.9 with a CSRF vulnerability in admincp.php?app=article&do=update. Connected sources describe an attack enabling remote exploitation to coerce administrators to review/approve articles; CVSS3 base score 8.8 (HIGH) with network attack vector, user interaction require...
CVE-2018-16320
idreamsoft iCMS 7.0.11 allows admincp.php?app=config Directory Traversal, resulting in execution of arbitrary PHP code from a ZIP file...
CVE-2018-16314
An issue was discovered in admincp.php in idreamsoft iCMS 7.0.11. When verifying CSRFTOKEN, if CSRFTOKEN does not exist, only the Referer header is validated, which can be bypassed via an admincp.php substring in this header...
CVE-2018-16314
An issue was discovered in admincp.php in idreamsoft iCMS 7.0.11. When verifying CSRFTOKEN, if CSRFTOKEN does not exist, only the Referer header is validated, which can be bypassed via an admincp.php substring in this header...