PT-2019-19363

Name of the Vulnerable Software and Affected Versions WUZHI CMS version 4.1.0 Description A security issue exists where an XSS attack can be performed. The issue is related to the "index.php?m=message&f=message&v=add" endpoint, specifically with the username variable. Recommendations For WUZHI CM...

CVE-2019-9107: Improper Neutralization of Input During Web Page Generation

XSS exists in WUZHI CMS 4.1.0 via index.php?m=attachment&f=imagecut&v=init&imgurl=XSS to coreframe/app/attachment/imagecut.php...

PT-2019-19364

Name of the Vulnerable Software and Affected Versions WUZHI CMS version 4.1.0 Description A security issue exists where an XSS attack can be performed. The issue is related to the "index.php?m=content&f=postinfo&v=listing&set iframe=" API endpoint, which is connected to the...

CVE-2019-9108: Improper Neutralization of Input During Web Page Generation

XSS exists in WUZHI CMS 4.1.0 via index.php?m=core&f=map&v=baidumap&x=XSS&y=XSS to coreframe/app/core/map.php...

PT-2019-19362

Name of the Vulnerable Software and Affected Versions WUZHI CMS version 4.1.0 Description The issue exists due to a cross-site scripting XSS flaw. This flaw can be exploited via the index.php endpoint, specifically through the m, f, v, x, and y parameters. The vulnerable endpoint is...

CVE-2019-9110: Improper Neutralization of Input During Web Page Generation

XSS exists in WUZHI CMS 4.1.0 via index.php?m=content&f=postinfo&v=listing&setiframe=XSS to coreframe/app/content/postinfo.php...

CVE-2019-9109: Improper Neutralization of Input During Web Page Generation

XSS exists in WUZHI CMS 4.1.0 via index.php?m=message&f=message&v=add&username=XSS to coreframe/app/message/message.php...

PT-2019-19361

Name of the Vulnerable Software and Affected Versions WUZHI CMS version 4.1.0 Description A security issue exists where an XSS attack can be performed. The issue is related to the "index.php?m=attachment&f=imagecut&v=init&imgurl=" endpoint, which is connected to the...

PT-2019-7049

Name of the Vulnerable Software and Affected Versions Vembu StoreGrid version 4.4.x Description The issue concerns the server web interface of Vembu StoreGrid, where the front page leaks the private IP address. This leak occurs due to incorrect processing of an index.php trailing slash, which...

CVE-2019-9042: Unrestricted Upload of File with Dangerous Type

An issue was discovered in Sitemagic CMS v4.4. In the index.php?SMExt=SMFiles URI, the user can upload a .php file to execute arbitrary code, as demonstrated by 404.php. This can only occur if the administrator neglects to set FileExtensionFilter and there are untrusted user accounts. NOTE: The...

CVE-2014-10079: Exposure of Sensitive Information to an Unauthorized Actor

In Vembu StoreGrid 4.4.x, the front page of the server web interface leaks the private IP address in the "ipaddress" hidden form value of the HTML source code, which is disclosed because of incorrect processing of an index.php/ trailing slash...

CVE-2019-8933

In DedeCMS 5.7SP2, attackers can upload a .php file to the uploads/ directory without being blocked by the Web Application Firewall, and then execute this file, via this sequence of steps: visiting the management page, clicking on the template, clicking on Default Template Management, clicking on...

CVE-2019-8910

An issue was discovered in WTCMS 1.0. It allows index.php?g=admin&m=setting&a=sitepost CSRF...

CVE-2019-8910

CVE-2019-8910 affects WTCMS 1.0 and describes a cross-site request forgery in index.php?g=admin&m=setting&a=site_post. Public sources (CNVD/Red Hat/NVD) note it can be exploited by remote attackers to alter website information. The NVD lists CVSS v3 base score 8.8 (HIGH) with network access, user...

CVE-2019-8910: Cross-Site Request Forgery (CSRF)

An issue was discovered in WTCMS 1.0. It allows index.php?g=admin&m=setting&a=sitepost CSRF...

PT-2019-19254

Name of the Vulnerable Software and Affected Versions WTCMS version 1.0 Description An issue was discovered that allows a CSRF attack through the "index.php?g=admin&m=setting&a=site post" endpoint, specifically targeting the site post action within the setting module of the admin interface...

CVE-2019-8407

HongCMS 3.0.0 is affected by CVE-2019-8407 due to a path traversal in the filename parameter of admin/index.php/language/edit, allowing arbitrary file read and write. The underlying cause is improper handling of "../" in the filename, enabling access to sensitive files. Impact: partial confidenti...

CVE-2019-8421: Improper Neutralization of Special Elements used in an SQL Command

upload/protected/modules/admini/views/post/index.php in BageCMS through 3.1.4 allows SQL Injection via the title or titleAlias parameter...

PT-2019-19019

Name of the Vulnerable Software and Affected Versions FeiFeiCms version 4.0.181010 Description The issue allows remote attackers to read or delete arbitrary files due to a directory traversal vulnerability. This can be exploited via specific API endpoints, such as...

PT-2019-19023

Name of the Vulnerable Software and Affected Versions BageCMS versions through 3.1.4 Description The issue allows SQL Injection via the title or titleAlias parameter in the upload/protected/modules/admini/views/post/index.php file. Recommendations For BageCMS versions through 3.1.4, update to a...