PT-2019-9477

Name of the Vulnerable Software and Affected Versions WUZHI CMS version 4.1.0 Description The issue is related to stored XSS, which can be triggered via the Extension module and specifically the SMS in station field. This field is accessible under the index.php?m=core URI, which is an API endpoin...

CVE-2018-17426: Improper Neutralization of Input During Web Page Generation

WUZHI CMS 4.1.0 has stored XSS via the "Extension module" "SMS in station" field under the index.php?m=core URI...

CVE-2018-18939: Improper Neutralization of Input During Web Page Generation

An issue was discovered in WUZHI CMS 4.1.0. There is stored XSS in index.php?m=core&f=index via a seventh input field...

PT-2018-14734

Name of the Vulnerable Software and Affected Versions WUZHI CMS version 4.1.0 Description An issue was discovered in WUZHI CMS, where there is stored XSS in "index.php?m=core&f=index" via an ontoggle attribute to details/open/ within a second input field. Recommendations For WUZHI CMS version...

PT-2018-14735

Name of the Vulnerable Software and Affected Versions WUZHI CMS version 4.1.0 Description A stored XSS issue was discovered in the index.php file, specifically via the seventh input field when accessing the core index module, at the endpoint "index.php?m=core&f=index". Recommendations For WUZHI C...

CVE-2018-18711: Cross-Site Request Forgery (CSRF)

An issue was discovered in WUZHI CMS 4.1.0. There is a CSRF vulnerability that can change the super administrator's password via index.php?m=core&f=panel&v=editinfo...

PT-2018-14589

Name of the Vulnerable Software and Affected Versions WUZHI CMS version 4.1.0 Description A CSRF issue allows changing the super administrator's password via the "index.php?m=core&f=panel&v=edit info" API endpoint. Recommendations For WUZHI CMS version 4.1.0, update to a newer version that contai...

CVE-2018-16350: Improper Neutralization of Input During Web Page Generation

WUZHI CMS 4.1.0 has XSS via the index.php?m=core&f=set&v=basic formstatcode parameter...

PT-2018-13510

Name of the Vulnerable Software and Affected Versions WUZHI CMS version 4.1.0 Description The issue is related to a form parameter in a specific PHP file, allowing for XSS attacks. The vulnerable parameter is statcode in the form on the page index.php?m=core&f=set&v=basic. Recommendations For WUZ...

CVE-2018-9926: Cross-Site Request Forgery (CSRF)

An issue was discovered in WUZHI CMS 4.1.0. There is a CSRF vulnerability that can add an admin account via index.php?m=core&f=power&v=add...

PT-2018-19094

Name of the Vulnerable Software and Affected Versions WUZHI CMS version 4.1.0 Description A CSRF issue was found that allows adding an admin account via the "index.php?m=core&f=power&v=add" endpoint. Recommendations For WUZHI CMS version 4.1.0, update to a newer version that contains a fix for th...