CVE-2026-7044: Unrestricted Upload of File with Dangerous Type

A vulnerability was found in GreenCMS up to 2.3. Affected is the function themeadd of the file /index.php?m=admin&c=custom&a=themeadd. The manipulation results in unrestricted upload. The attack can be launched remotely. The exploit has been made public and could be used. This vulnerability only...

CVE-2025-9415: Unrestricted Upload of File with Dangerous Type

A vulnerability was identified in GreenCMS up to 2.3.0603. This affects an unknown part of the file /index.php?m=admin&c=media&a=fileconnect. The manipulation of the argument upload leads to unrestricted upload. The attack is possible to be carried out remotely. The exploit is publicly available...

CVE-2024-52680: Improper Neutralization of Input During Web Page Generation

EyouCMS 1.6.7 is vulnerable to Cross Site Scripting XSS in /login.php?m=admin&c=System&a=web&lang=cn...

CVE-2023-2057: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in EyouCms 1.5.4. It has been classified as problematic. Affected is an unknown function of the file login.php?m=admin&c=Arctype&a=edit of the component New Picture Handler. The manipulation of the argument litpicloca leads to cross site scripting. It is possible to laun...

CVE-2022-28918

GreenCMS v2.3.0603 was discovered to contain an arbitrary file deletion vulnerability via /index.php?m=admin&c=custom&a=plugindelhandle&pluginname=...

PT-2021-10519

Name of the Vulnerable Software and Affected Versions: EyouCMS version 1.3.6 Description: A Cross Site Request Forgery CSRF issue exists, allowing an attacker to add an htm page that can execute js code via the login.php endpoint with specific parameters: m=admin, c=Filemanager, a=newfile, and...

CVE-2019-17612: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in 74CMS v5.2.8. There is a SQL Injection generated by the list method in the Common/Controller/BackendController.class.php file via the index.php?m=Admin&c=Ad&a=category sort parameter...

PT-2019-15232

Name of the Vulnerable Software and Affected Versions 74CMS version 5.2.8 Description An issue was discovered that allows SQL Injection, generated by the list method in the Common/Controller/BackendController.class.php file via the index.php?m=Admin&c=Ad&a=category API endpoint, specifically...

CVE-2019-11374: Cross-Site Request Forgery (CSRF)

74CMS v5.0.1 has a CSRF vulnerability to add a new admin user via the index.php?m=Admin&c=admin&a=add URI...

PT-2019-12265

Name of the Vulnerable Software and Affected Versions 74CMS version 5.0.1 Description The issue allows an attacker to add a new admin user via the "index.php?m=Admin&c=admin&a=add" API endpoint. This is due to a CSRF vulnerability. Recommendations For version 5.0.1, update to a newer version that...

PT-2019-11990

Name of the Vulnerable Software and Affected Versions 74cms version 5.0.1 Description The issue allows remote attackers to execute arbitrary PHP code. This is achieved via the site domain parameter in the /index.php?m=Admin&c=config&a=edit API endpoint. Recommendations For version 5.0.1, as a...

CVE-2019-9652: Cross-Site Request Forgery (CSRF)

There is a CSRF in SDCMS V1.7 via an m=admin&c=theme&a=edit request. It allows PHP code injection by providing a filename in the file parameter, and providing file content in the t2 parameter...

PT-2019-19778

Name of the Vulnerable Software and Affected Versions SDCMS version 1.7 Description The issue concerns a CSRF that allows PHP code injection. This is achieved by sending a request with m=admin&c=theme&a=edit and providing a filename in the file parameter, along with file content in the t2...

PT-2019-19419

Name of the Vulnerable Software and Affected Versions SchoolCMS version 2.3.1 Description The issue allows for file upload via the logo upload feature at "admin.php?m=admin&c=site&a=save" by manipulating the file extension and content type. Specifically, an attacker can use the .jpg extension,...

PT-2018-15006

Name of the Vulnerable Software and Affected Versions sikcms version 1.1 Description The issue allows for CSRF via the "admin.php?m=Admin&c=Users&a=userAdd" endpoint to add an administrator account. Recommendations For version 1.1, as a temporary workaround, consider disabling access to the...

CVE-2018-19376: Cross-Site Request Forgery (CSRF)

An issue was discovered in GreenCMS v2.3.0603. There is a CSRF vulnerability that allows attackers to delete a log file via the index.php?m=admin&c=data&a=clear URI...

PT-2018-14944

Name of the Vulnerable Software and Affected Versions GreenCMS version 2.3.0603 Description An issue was discovered that allows attackers to delete a log file due to a CSRF vulnerability. This can be achieved via the "index.php?m=admin&c=data&a=clear" URI. Recommendations For GreenCMS version...

Design/Logic Flaw

GreenCMS v2.3.0603 allows remote authenticated administrators to delete arbitrary files by modifying a base64-encoded pathname in an m=admin&c=media&a=delfilehandle&id= call, related to the m=admin&c=media&a=restorefile delete button...

CVE-2018-19329

GreenCMS v2.3.0603 allows remote authenticated administrators to delete arbitrary files by modifying a base64-encoded pathname in an m=admin&c=media&a=delfilehandle&id= call, related to the m=admin&c=media&a=restorefile delete button...

CVE-2018-19329

GreenCMS v2.3.0603 allows remote authenticated administrators to delete arbitrary files by modifying a base64-encoded pathname in an m=admin&c=media&a=delfilehandle&id= call, related to the m=admin&c=media&a=restorefile delete button...