125 matches found
CVE-2021-46362
CVE-2021-46362: FreeMarker Server-Side Template Injection in Magnolia CMS A Server-Side Template Injection SSTI vulnerability in the Registration and Forgotten Password forms of Magnolia v6.2.3 and below allows unauthenticated attackers to execute arbitrary code via a crafted payload entered into...
Magnolia-CMS-6.2.19-Stored-Cross-Site-Scripting-CVE-2022-33098
Magnolia CMS = 6.2.19 Stored Cross Site Scripting CVE-2022-33098 Table of Contents 1. Overview 2. Detailed Description 3. Proof of Concept 4. Solution 5. Disclosure Timeline 6. References 7. Credits 8. Legal Notices Overview Revision: 1.0 Impact: Stored cross-site scripting in Magnolia CMS 6.2.19...
CVE-2021-46364
CVE-2021-46364: YAML Deserialization in Magnolia CMS Magnolia versions =6.2.3 has a Snake YAML parser which is vulnerable to deserialization attacks that can allow an attacker to call arbitrary Java constructors when importing YAML files. Remote Code Execution has been achieved using this...
CVE-2021-46366
CVE-2021-46366: Credential Bruteforce Attack via CSRF + Open Redirect in Magnolia CMS An issue in the Login page of Magnolia CMS v6.2.3 and below allows attackers to exploit both an Open Redirect vulnerability and Cross-Site Request Forgery CSRF in order to brute force and exfiltrate users'...
CVE-2021-46363
CVE-2021-46363: Formula Injection in Magnolia CMS An issue in the Export function of Magnolia v6.2.3 and below allows attackers to perform Formula Injection attacks via crafted CSV/XLS files. These formulas may result in arbitrary code execution on a victim's computer when opening the exported...
CVE-2021-46361
CVE-2021-46361: FreeMarker Restriction Bypass in Magnolia CMS An issue in the FreeMarker Filter of Magnolia CMS v6.2.11 and below allows attackers to bypass security restrictions and execute arbitrary code via a crafted FreeMarker payload. Vendor Disclosure: The vendor's disclosure and fix for th...
CVE-2021-46365
CVE-2021-46365: Unsafe XML Parsing in Magnolia CMS An issue in the Export function of Magnolia v6.2.3 and below allows attackers to execute XML External Entity attacks via a crafted XLF file. Vendor Disclosure: The vendor's disclosure and fix for this vulnerability can be found here. Requirements...
MAGNOLIA-8348
MAGNOLIA-8348: FreeMarker Restriction Bypass 3 in Magnolia CMS An issue in the FreeMarker Filter of Magnolia CMS v6.2.17 and below allows attackers to bypass security restrictions and execute arbitrary code, read/write/move/copy/delete arbitrary files or launch DoS attacks via a crafted FreeMarke...
MAGNOLIA-8281
MAGNOLIA-8281: FreeMarker Restriction Bypass 2 in Magnolia CMS An issue in the FreeMarker Filter of Magnolia CMS v6.2.16 and below allows attackers to bypass security restrictions and read/write/move/copy/delete arbitrary files via a crafted FreeMarker payload. Arbitrary code execution was...
magnolia-rce
Exploit Title: Magnolia DX Core 6.3.8 - Command Injection Date: 05/16/2025 Exploit Author: tmrswrr Version: 6.3.8 Vendor home page: https://docs.magnolia-cms.com/home/ Product: https://docs.magnolia-cms.com/product-docs/6.3/releases/release-notes-for-magnolia-cms-6.3.8/ 1. Authenticate as an admi...
CVE-2026-18478 Stored XSS in Magnolia CMS
Magnolia CMS is vulnerable to Stored XSS in import functionality. An attacker with editor privileges can inject arbitrary HTML and JS into the name of uploaded image, which will be rendered/executed when opening uploaded image. The issue was fixed in version 6.3.10...
CVE-2026-18478 Stored XSS in Magnolia CMS
Magnolia CMS is vulnerable to Stored XSS in import functionality. An attacker with editor privileges can inject arbitrary HTML and JS into the name of uploaded image, which will be rendered/executed when opening uploaded image. The issue was fixed in version 6.3.10...
CVE-2026-18478
Magnolia CMS is vulnerable to Stored XSS in import functionality. An attacker with editor privileges can inject arbitrary HTML and JS into the name of uploaded image, which will be rendered/executed when opening uploaded image. The issue was fixed in version 6.3.10...
CVE-2026-18478
Magnolia CMS is affected by a Stored XSS in the import functionality (CVE-2026-18478). An attacker with editor privileges can inject arbitrary HTML/JavaScript into the name of an uploaded image, which is rendered/executed when the image is opened. The issue is fixed in Magnolia CMS version 6.3.10...
PT-2026-69841
Name of the Vulnerable Software and Affected Versions Magnolia CMS versions prior to 6.3.10 Description Stored Cross-Site Scripting XSS exists in the import functionality. An attacker with editor privileges can inject arbitrary HTML and JavaScript into the name of an uploaded image, which is then...
CVE-2026-18478: Improper Neutralization of Input During Web Page Generation
Magnolia CMS is vulnerable to Stored XSS in import functionality. An attacker with editor privileges can inject arbitrary HTML and JS into the name of uploaded image, which will be rendered/executed when opening uploaded image. The issue was fixed in version 6.3.10...
Magnolia CMS Login Panel - Detect
Magnolia CMS login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Magnolia CMS login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Magnolia CMS Login Panel - Detect',...
EUVD-2013-4477
Malware in sbrugna...