112 matches found
CVE-2021-46363
CVE-2021-46363: Inyección de fórmulas en Magnolia CMS Un problema en la función Export de Magnolia v6.2.3 y versiones anteriores permite a los atacantes realizar ataques de inyección de fórmulas mediante archivos CSV/XLS manipulados. Estas fórmulas pueden provocar la ejecución de código arbitrari...
CVE-2021-46365
CVE-2021-46365: Unsafe XML Parsing in Magnolia CMS An issue in the Export function of Magnolia v6.2.3 and below allows attackers to execute XML External Entity attacks via a crafted XLF file. Vendor Disclosure: The vendor's disclosure and fix for this vulnerability can be found here. Requirements...
MAGNOLIA-8348
MAGNOLIA-8348: FreeMarker Restriction Bypass 3 in Magnolia CMS An issue in the FreeMarker Filter of Magnolia CMS v6.2.17 and below allows attackers to bypass security restrictions and execute arbitrary code, read/write/move/copy/delete arbitrary files or launch DoS attacks via a crafted FreeMarke...
MAGNOLIA-8281
MAGNOLIA-8281: FreeMarker Restriction Bypass 2 in Magnolia CMS An issue in the FreeMarker Filter of Magnolia CMS v6.2.16 and below allows attackers to bypass security restrictions and read/write/move/copy/delete arbitrary files via a crafted FreeMarker payload. Arbitrary code execution was...
magnolia-rce
Exploit Title: Magnolia DX Core 6.3.8 - Command Injection Date: 05/16/2025 Exploit Author: tmrswrr Version: 6.3.8 Vendor home page: https://docs.magnolia-cms.com/home/ Product: https://docs.magnolia-cms.com/product-docs/6.3/releases/release-notes-for-magnolia-cms-6.3.8/ 1. Authenticate as an admi...
CVE-2021-46366
CVE-2021-46366: Ataque de fuerza bruta de credenciales mediante CSRF + redirección abierta en Magnolia CMS Un fallo en la página de inicio de sesión de Magnolia CMS v6.2.3 y anteriores permite a los atacantes explotar tanto una vulnerabilidad de redirección abierta como la falsificación de...
CVE-2021-46364
CVE-2021-46364: Deserialización de YAML en Magnolia CMS Magnolia versiones =6.2.3 tiene un analizador Snake YAML que es vulnerable a ataques de deserialización que pueden permitir a un atacante invocar constructores arbitrarios de Java al importar archivos YAML. Se ha logrado ejecución remota de...
CVE-2021-46362
CVE-2021-46362: Inyección de plantillas del lado del servidor FreeMarker en Magnolia CMS Una vulnerabilidad de inyección de plantillas del lado del servidor SSTI en los formularios de Registro y Contraseña Olvidada de Magnolia v6.2.3 y versiones anteriores permite a atacantes no autenticados...
CVE-2021-46361
CVE-2021-46361: FreeMarker Restriction Bypass in Magnolia CMS An issue in the FreeMarker Filter of Magnolia CMS v6.2.11 and below allows attackers to bypass security restrictions and execute arbitrary code via a crafted FreeMarker payload. Vendor Disclosure: The vendor's disclosure and fix for th...
Magnolia-CMS-6.2.19-Stored-Cross-Site-Scripting-CVE-2022-33098
Magnolia CMS = 6.2.19 Stored Cross Site Scripting CVE-2022-33098 Table of Contents 1. Overview 2. Detailed Description 3. Proof of Concept 4. Solution 5. Disclosure Timeline 6. References 7. Credits 8. Legal Notices Overview Revision: 1.0 Impact: Stored cross-site scripting in Magnolia CMS 6.2.19...
CVE-2026-18478 Stored XSS in Magnolia CMS
Magnolia CMS is vulnerable to Stored XSS in import functionality. An attacker with editor privileges can inject arbitrary HTML and JS into the name of uploaded image, which will be rendered/executed when opening uploaded image. The issue was fixed in version 6.3.10...
CVE-2026-18478
Magnolia CMS is affected by a Stored XSS in the import functionality (CVE-2026-18478). An attacker with editor privileges can inject arbitrary HTML/JavaScript into the name of an uploaded image, which is rendered/executed when the image is opened. The issue is fixed in Magnolia CMS version 6.3.10...
CVE-2026-18478
Magnolia CMS is vulnerable to Stored XSS in import functionality. An attacker with editor privileges can inject arbitrary HTML and JS into the name of uploaded image, which will be rendered/executed when opening uploaded image. The issue was fixed in version 6.3.10...
CVE-2026-18478 Stored XSS in Magnolia CMS
Magnolia CMS is vulnerable to Stored XSS in import functionality. An attacker with editor privileges can inject arbitrary HTML and JS into the name of uploaded image, which will be rendered/executed when opening uploaded image. The issue was fixed in version 6.3.10...
CVE-2026-18478: Improper Neutralization of Input During Web Page Generation
Magnolia CMS is vulnerable to Stored XSS in import functionality. An attacker with editor privileges can inject arbitrary HTML and JS into the name of uploaded image, which will be rendered/executed when opening uploaded image. The issue was fixed in version 6.3.10...
EUVD-2013-4477
Malware in sbrugna...
EUVD-2021-12773
Malware in sbrugna...
EUVD-2021-12774
Malware in sbrugna...