13416 matches found
CVE-2019-9107: Improper Neutralization of Input During Web Page Generation
XSS exists in WUZHI CMS 4.1.0 via index.php?m=attachment&f=imagecut&v=init&imgurl=XSS to coreframe/app/attachment/imagecut.php...
CVE-2019-9108: Improper Neutralization of Input During Web Page Generation
XSS exists in WUZHI CMS 4.1.0 via index.php?m=core&f=map&v=baidumap&x=XSS&y=XSS to coreframe/app/core/map.php...
CVE-2019-9110: Improper Neutralization of Input During Web Page Generation
XSS exists in WUZHI CMS 4.1.0 via index.php?m=content&f=postinfo&v=listing&setiframe=XSS to coreframe/app/content/postinfo.php...
CVE-2019-9109: Improper Neutralization of Input During Web Page Generation
XSS exists in WUZHI CMS 4.1.0 via index.php?m=message&f=message&v=add&username=XSS to coreframe/app/message/message.php...
PT-2019-7049
Name of the Vulnerable Software and Affected Versions Vembu StoreGrid version 4.4.x Description The issue concerns the server web interface of Vembu StoreGrid, where the front page leaks the private IP address. This leak occurs due to incorrect processing of an index.php trailing slash, which...
CVE-2019-9042: Unrestricted Upload of File with Dangerous Type
An issue was discovered in Sitemagic CMS v4.4. In the index.php?SMExt=SMFiles URI, the user can upload a .php file to execute arbitrary code, as demonstrated by 404.php. This can only occur if the administrator neglects to set FileExtensionFilter and there are untrusted user accounts. NOTE: The...
CVE-2014-10079: Exposure of Sensitive Information to an Unauthorized Actor
In Vembu StoreGrid 4.4.x, the front page of the server web interface leaks the private IP address in the "ipaddress" hidden form value of the HTML source code, which is disclosed because of incorrect processing of an index.php/ trailing slash...
CVE-2019-8933
In DedeCMS 5.7SP2, attackers can upload a .php file to the uploads/ directory without being blocked by the Web Application Firewall, and then execute this file, via this sequence of steps: visiting the management page, clicking on the template, clicking on Default Template Management, clicking on...
CVE-2019-8910
An issue was discovered in WTCMS 1.0. It allows index.php?g=admin&m=setting&a=sitepost CSRF...
CVE-2019-8910
CVE-2019-8910 affects WTCMS 1.0 and describes a cross-site request forgery in index.php?g=admin&m=setting&a=site_post. Public sources (CNVD/Red Hat/NVD) note it can be exploited by remote attackers to alter website information. The NVD lists CVSS v3 base score 8.8 (HIGH) with network access, user...
PT-2019-19254
Name of the Vulnerable Software and Affected Versions WTCMS version 1.0 Description An issue was discovered that allows a CSRF attack through the "index.php?g=admin&m=setting&a=site post" endpoint, specifically targeting the site post action within the setting module of the admin interface...
CVE-2019-8910: Cross-Site Request Forgery (CSRF)
An issue was discovered in WTCMS 1.0. It allows index.php?g=admin&m=setting&a=sitepost CSRF...
CVE-2019-8407
HongCMS 3.0.0 is affected by CVE-2019-8407 due to a path traversal in the filename parameter of admin/index.php/language/edit, allowing arbitrary file read and write. The underlying cause is improper handling of "../" in the filename, enabling access to sensitive files. Impact: partial confidenti...
PT-2019-19019
Name of the Vulnerable Software and Affected Versions FeiFeiCms version 4.0.181010 Description The issue allows remote attackers to read or delete arbitrary files due to a directory traversal vulnerability. This can be exploited via specific API endpoints, such as...
PT-2019-19015
Name of the Vulnerable Software and Affected Versions HongCMS version 3.0.0 Description The issue allows for arbitrary file read and write operations. This is achieved by utilizing a ../ in the filename parameter to the "admin/index.php/language/edit" API endpoint. Recommendations For HongCMS...
CVE-2019-8407: Improper Limitation of a Pathname to a Restricted Directory
HongCMS 3.0.0 allows arbitrary file read and write operations via a ../ in the filename parameter to the admin/index.php/language/edit URI...
PT-2019-19023
Name of the Vulnerable Software and Affected Versions BageCMS versions through 3.1.4 Description The issue allows SQL Injection via the title or titleAlias parameter in the upload/protected/modules/admini/views/post/index.php file. Recommendations For BageCMS versions through 3.1.4, update to a...
CVE-2019-8421: Improper Neutralization of Special Elements used in an SQL Command
upload/protected/modules/admini/views/post/index.php in BageCMS through 3.1.4 allows SQL Injection via the title or titleAlias parameter...
