CVE-2023-41425

CVE-2023-41425 Descripción Vulnerabilidad de Cross Site Scripting en Wonder CMS v.3.2.0 hasta v.3.4.2 permite a un atacante remoto ejecutar código arbitrario mediante un script manipulado cargado en el componente installModule. Funcionamiento El exploit adjunto "exploit.py" realiza las siguientes...

CVE-2023-41425

Wonder CMS RCE | | Descripción : XSS a RCE, Wonder CMS 3.2.0 evil/evil.php EOF zip -r evil.zip evil/ JS payload that will install the new theme cat form+action=" EOF Starting a new web server to serve payloads sudo python3 -m http.server $LPORTWEB & | | Después de enviar el XSS RCE al...

CVE-2023-41425-wonderCMS_RCE

CVE-2023-41425-wonderCMSRCE Vulnerabilidad de Cross Site Scripting en Wonder CMS v.3.2.0 hasta v.3.4.2 permite a un atacante remoto ejecutar código arbitrario mediante un script manipulado cargado en el componente installModule. Solo con fines educativos Requiere conocimiento del loginURL, acceso...

CVE-2023-41425

RCE para WonderCMS versiones v3.2.0 a v3.4.2 Las versiones de WonderCMS v3.2.0 a v3.4.2 con vulnerabilidad XSS permiten a un actor malicioso lograr RCE subiendo un componente al installModule CVE-2023-41425 No es necesario conocer la contraseña. Características: Explotación automatizada de...

CVE-2023-41425

CVE-2023-41425 Description A Cross Site Scripting vulnerability in Wonder CMS Version 3.2.0 to Version 3.4.2 allows a remote attacker to execute arbitrary code via a crafted script uploaded to the installModule component. This is a modifed version of the original exploit by prodigiousMind which...

CVE-2023-50564

CVE-2023-50564 - Exploit de Pluck CMS v4.7.18 Resumen Este script explota una vulnerabilidad de subida arbitraria de archivos autenticada en Pluck CMS v4.7.18 CVE-2023-50564. Al aprovechar esta vulnerabilidad, un atacante autenticado puede subir un archivo PHP malicioso, permitiendo la ejecución ...

CVE-2023-41425-WonderCMS-Authenticated-RCE

CVE-2023-41425-WonderCMS-Authenticated-RCE Description WonderCMS v3.2.0 - v3.4.2 is vulnerable. Remote attackers can take full control of the server using a Cross-Site Scripting XSS exploit For educational purposes only . Here's the game plan: How it works: The exploit abuses the installModule...

CVE-2023-41425

CVE-2023-41425 CVE-2023-41425 is a reflected XSS vulnerability in Wonder CMS which further allows to execute arbitrary code through a malicious script via the installModule component. Usage Running the exploit against the target's loginURL, specifying our IP and port for the web server hosting th...

CVE-2023-50564

CVE-2023-50564 📌 Description This exploit allows an authenticated admin in Pluck CMS v4.7.18 to upload a malicious ZIP module containing a PHP shell, resulting in remote code execution RCE. ⚙️ Features Authenticates to the target using a valid username and password Automatically creates a ZIP...

CVE-2026-86438: Missing Authorization

Lara Dashboard before 1.3.2 fails to authorize the MarketplaceModuleBrowser installModule Livewire action, allowing non-Superadmin administrators to install modules. Attackers can download and auto-activate arbitrary PHP modules from the marketplace over unsigned HTTP requests, achieving remote...

CVE-2023-41425

Cross Site Scripting vulnerability in Wonder CMS v.3.2.0 thru v.3.4.2 allows a remote attacker to execute arbitrary code via a crafted script uploaded to the installModule component...

CVE-2023-26128

All versions of the package keep-module-latest are vulnerable to Command Injection due to missing input sanitization or other checks and sandboxes being employed to the installModule function. Note: To execute the code snippet and potentially exploit the vulnerability, the attacker needs to have...

Exploit for Cross-site Scripting in Wondercms

CVE-2023-41425-wonderCMSRCE Cross Site Scripting vulnerabilit...

The vulnerability of the installModule component in the Wonder CMS content management system allows attackers to perform cross-site scripting attacks.

The vulnerability of the installModule component in the Wonder CMS content management system is related to the lack of protective measures for the website structure. Exploiting this vulnerability allows a remote attacker to perform cross-site scripting attacks...

CVE-2023-41425

Cross Site Scripting vulnerability in Wonder CMS v.3.2.0 thru v.3.4.2 allows a remote attacker to execute arbitrary code via a crafted script uploaded to the installModule component...

CVE-2023-41425: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting vulnerability in Wonder CMS v.3.2.0 thru v.3.4.2 allows a remote attacker to execute arbitrary code via a crafted script uploaded to the installModule component...

WonderCMS Security Breach

WonderCMS is an open source PHP-based content management system CMS. A security vulnerability exists in WonderCMS versions v.3.2.0 through v.3.4.2. An attacker can exploit this vulnerability to execute arbitrary code via specially crafted scripts uploaded to the installModule component...

CVE-2023-41425

Cross Site Scripting vulnerability in Wonder CMS v.3.2.0 thru v.3.4.2 allows a remote attacker to execute arbitrary code via a crafted script uploaded to the installModule component...

CVE-2023-41425

Cross Site Scripting vulnerability in Wonder CMS v.3.2.0 thru v.3.4.2 allows a remote attacker to execute arbitrary code via a crafted script uploaded to the installModule component...

CVE-2023-41425

Cross Site Scripting vulnerability in Wonder CMS v.3.2.0 thru v.3.4.2 allows a remote attacker to execute arbitrary code via a crafted script uploaded to the installModule component...