23 matches found
CVE-2026-7044: Unrestricted Upload of File with Dangerous Type
A vulnerability was found in GreenCMS up to 2.3. Affected is the function themeadd of the file /index.php?m=admin&c=custom&a=themeadd. The manipulation results in unrestricted upload. The attack can be launched remotely. The exploit has been made public and could be used. This vulnerability only...
CVE-2025-9415: Unrestricted Upload of File with Dangerous Type
A vulnerability was identified in GreenCMS up to 2.3.0603. This affects an unknown part of the file /index.php?m=admin&c=media&a=fileconnect. The manipulation of the argument upload leads to unrestricted upload. The attack is possible to be carried out remotely. The exploit is publicly available...
CVE-2024-52680: Improper Neutralization of Input During Web Page Generation
EyouCMS 1.6.7 is vulnerable to Cross Site Scripting XSS in /login.php?m=admin&c=System&a=web&lang=cn...
CVE-2023-2057: Improper Neutralization of Input During Web Page Generation
A vulnerability was found in EyouCms 1.5.4. It has been classified as problematic. Affected is an unknown function of the file login.php?m=admin&c=Arctype&a=edit of the component New Picture Handler. The manipulation of the argument litpicloca leads to cross site scripting. It is possible to laun...
CVE-2019-17612: Improper Neutralization of Special Elements used in an SQL Command
An issue was discovered in 74CMS v5.2.8. There is a SQL Injection generated by the list method in the Common/Controller/BackendController.class.php file via the index.php?m=Admin&c=Ad&a=category sort parameter...
CVE-2019-11374: Cross-Site Request Forgery (CSRF)
74CMS v5.0.1 has a CSRF vulnerability to add a new admin user via the index.php?m=Admin&c=admin&a=add URI...
PT-2019-11990
Name of the Vulnerable Software and Affected Versions 74cms version 5.0.1 Description The issue allows remote attackers to execute arbitrary PHP code. This is achieved via the site domain parameter in the /index.php?m=Admin&c=config&a=edit API endpoint. Recommendations For version 5.0.1, as a...
CVE-2019-9652: Cross-Site Request Forgery (CSRF)
There is a CSRF in SDCMS V1.7 via an m=admin&c=theme&a=edit request. It allows PHP code injection by providing a filename in the file parameter, and providing file content in the t2 parameter...
PT-2018-15006
Name of the Vulnerable Software and Affected Versions sikcms version 1.1 Description The issue allows for CSRF via the "admin.php?m=Admin&c=Users&a=userAdd" endpoint to add an administrator account. Recommendations For version 1.1, as a temporary workaround, consider disabling access to the...
CVE-2018-19376: Cross-Site Request Forgery (CSRF)
An issue was discovered in GreenCMS v2.3.0603. There is a CSRF vulnerability that allows attackers to delete a log file via the index.php?m=admin&c=data&a=clear URI...
PT-2018-14944
Name of the Vulnerable Software and Affected Versions GreenCMS version 2.3.0603 Description An issue was discovered that allows attackers to delete a log file due to a CSRF vulnerability. This can be achieved via the "index.php?m=admin&c=data&a=clear" URI. Recommendations For GreenCMS version...
CVE-2018-19329
GreenCMS v2.3.0603 allows remote authenticated administrators to delete arbitrary files by modifying a base64-encoded pathname in an m=admin&c=media&a=delfilehandle&id= call, related to the m=admin&c=media&a=restorefile delete button...
Design/Logic Flaw
GreenCMS v2.3.0603 allows remote authenticated administrators to delete arbitrary files by modifying a base64-encoded pathname in an m=admin&c=media&a=delfilehandle&id= call, related to the m=admin&c=media&a=restorefile delete button...
CVE-2018-19329
GreenCMS v2.3.0603 allows remote authenticated administrators to delete arbitrary files by modifying a base64-encoded pathname in an m=admin&c=media&a=delfilehandle&id= call, related to the m=admin&c=media&a=restorefile delete button...
CVE-2018-19329
GreenCMS v2.3.0603 allows remote authenticated administrators to delete arbitrary files by modifying a base64-encoded pathname in an m=admin&c=media&a=delfilehandle&id= call, related to the m=admin&c=media&a=restorefile delete button...
CVE-2018-19329: Improper Limitation of a Pathname to a Restricted Directory
GreenCMS v2.3.0603 allows remote authenticated administrators to delete arbitrary files by modifying a base64-encoded pathname in an m=admin&c=media&a=delfilehandle&id= call, related to the m=admin&c=media&a=restorefile delete button...
PT-2018-14919
Name of the Vulnerable Software and Affected Versions GreenCMS version 2.3.0603 Description The issue allows remote authenticated administrators to delete arbitrary files by modifying a base64-encoded pathname in an "m=admin&c=media&a=delfilehandle&id=" call. This is related to the delete button ...
PT-2018-14915
Name of the Vulnerable Software and Affected Versions SRCMS version 3.0.0 Description The issue allows for a CSRF attack via the "admin.php?m=Admin&c=gifts&a=update" API endpoint to change goods prices with the privileges of a super administrator. Recommendations For SRCMS version 3.0.0, as a...
PT-2018-14914
Name of the Vulnerable Software and Affected Versions SRCMS version 3.0.0 Description The issue allows for a CSRF attack via the "admin.php?m=Admin&c=manager&a=update" endpoint to change the username and password of the super administrator account. Recommendations For SRCMS version 3.0.0, update ...