179 matches found
CVE-2021-46363
CVE-2021-46363: Inyección de fórmulas en Magnolia CMS Un problema en la función Export de Magnolia v6.2.3 y versiones anteriores permite a los atacantes realizar ataques de inyección de fórmulas mediante archivos CSV/XLS manipulados. Estas fórmulas pueden provocar la ejecución de código arbitrari...
CVE-2021-46365
CVE-2021-46365: Unsafe XML Parsing in Magnolia CMS An issue in the Export function of Magnolia v6.2.3 and below allows attackers to execute XML External Entity attacks via a crafted XLF file. Vendor Disclosure: The vendor's disclosure and fix for this vulnerability can be found here. Requirements...
MAGNOLIA-8348
MAGNOLIA-8348: Omisión de restricciones de FreeMarker 3 en Magnolia CMS Un problema en el filtro FreeMarker de Magnolia CMS v6.2.17 y versiones anteriores permite a los atacantes omitir las restricciones de seguridad y ejecutar código arbitrario, leer/escribir/mover/copiar/eliminar archivos...
MAGNOLIA-8281
MAGNOLIA-8281: FreeMarker Restriction Bypass 2 en Magnolia CMS Un problema en el FreeMarker Filter de Magnolia CMS v6.2.16 y anteriores permite a los atacantes eludir las restricciones de seguridad y leer/escribir/mover/copiar/eliminar archivos arbitrarios mediante un payload de FreeMarker...
magnolia-rce
Título del exploit: Magnolia DX Core 6.3.8 - Inyección de comandos Fecha: 05/16/2025 Autor del exploit: tmrswrr Versión: 6.3.8 Página principal del proveedor: https://docs.magnolia-cms.com/home/ Producto: https://docs.magnolia-cms.com/product-docs/6.3/releases/release-notes-for-magnolia-cms-6.3.8...
CVE-2021-46366
CVE-2021-46366: Ataque de fuerza bruta de credenciales mediante CSRF + redirección abierta en Magnolia CMS Un fallo en la página de inicio de sesión de Magnolia CMS v6.2.3 y anteriores permite a los atacantes explotar tanto una vulnerabilidad de redirección abierta como la falsificación de...
CVE-2021-46364
CVE-2021-46364: Deserialización de YAML en Magnolia CMS Magnolia versiones =6.2.3 tiene un analizador Snake YAML que es vulnerable a ataques de deserialización que pueden permitir a un atacante invocar constructores arbitrarios de Java al importar archivos YAML. Se ha logrado ejecución remota de...
CVE-2021-46362
CVE-2021-46362: Inyección de plantillas del lado del servidor FreeMarker en Magnolia CMS Una vulnerabilidad de inyección de plantillas del lado del servidor SSTI en los formularios de Registro y Contraseña Olvidada de Magnolia v6.2.3 y versiones anteriores permite a atacantes no autenticados...
CVE-2021-46361
CVE-2021-46361: Omisión de Restricción de FreeMarker en Magnolia CMS Un problema en el Filtro FreeMarker de Magnolia CMS v6.2.11 y versiones anteriores permite a los atacantes eludir las restricciones de seguridad y ejecutar código arbitrario mediante una carga útil de FreeMarker manipulada...
Magnolia-CMS-6.2.19-Stored-Cross-Site-Scripting-CVE-2022-33098
Magnolia CMS = 6.2.19 Cross-Site Scripting Almacenado CVE-2022-33098 Tabla de Contenidos 1. Visión General 2. Descripción Detallada 3. Prueba de Concepto 4. Solución 5. Cronología de Divulgación 6. Referencias 7. Créditos 8. Avisos Legales Visión General Revisión: 1.0 Impacto: Cross-Site Scriptin...
CVE-2026-18478
Magnolia CMS is vulnerable to Stored XSS in import functionality. An attacker with editor privileges can inject arbitrary HTML and JS into the name of uploaded image, which will be rendered/executed when opening uploaded image. The issue was fixed in version 6.3.10...
EUVD-2026-55624
Magnolia CMS is vulnerable to Stored XSS in import functionality. An attacker with editor privileges can inject arbitrary HTML and JS into the name of uploaded image, which will be rendered/executed when opening uploaded image. The issue was fixed in version 6.3.10...
CVE-2026-18478 Stored XSS in Magnolia CMS
Magnolia CMS is vulnerable to Stored XSS in import functionality. An attacker with editor privileges can inject arbitrary HTML and JS into the name of uploaded image, which will be rendered/executed when opening uploaded image. The issue was fixed in version 6.3.10...
CVE-2026-18478
Magnolia CMS is affected by a Stored XSS in the import functionality (CVE-2026-18478). An attacker with editor privileges can inject arbitrary HTML/JavaScript into the name of an uploaded image, which is rendered/executed when the image is opened. The issue is fixed in Magnolia CMS version 6.3.10...
CVE-2026-18478
Magnolia CMS is vulnerable to Stored XSS in import functionality. An attacker with editor privileges can inject arbitrary HTML and JS into the name of uploaded image, which will be rendered/executed when opening uploaded image. The issue was fixed in version 6.3.10...
CVE-2026-18478 Stored XSS in Magnolia CMS
Magnolia CMS is vulnerable to Stored XSS in import functionality. An attacker with editor privileges can inject arbitrary HTML and JS into the name of uploaded image, which will be rendered/executed when opening uploaded image. The issue was fixed in version 6.3.10...
CVE-2026-18478: Improper Neutralization of Input During Web Page Generation
Magnolia CMS is vulnerable to Stored XSS in import functionality. An attacker with editor privileges can inject arbitrary HTML and JS into the name of uploaded image, which will be rendered/executed when opening uploaded image. The issue was fixed in version 6.3.10...
EUVD-2013-4477
Malware in sbrugna...