34 matches found
CVE-2019-13340
CVE-2019-13340 affects MiniCMS v1.10 with a stored XSS in mc-admin/post-edit.php (content box). The root cause is unsanitized input being stored in the content field, enabling an attacker to steal a user’s cookie. Impact is aligned with stored XSS, enabling credential/session data exposure; explo...
CVE-2019-13186
Affected software: MiniCMS V1.10. The vulnerability is a stored XSS in mc-admin/post-edit.php (via the content box; also similar references mention a tags box). Root cause stated: stored cross-site scripting allows an attacker to obtain a user’s cookie. The CVE entry and Red Hat quis confirm the ...
Sql injection
MiniCMS V1.10 has XSS via the mc-admin/post-edit.php query string, a related issue to CVE-2018-10296 and CVE-2018-16233...
CVE-2018-20520
MiniCMS V1.10 is affected. The vulnerability is an XSS in the admin post editor: mc-admin/post-edit.php is exploitable via the query string (CVE-2018-20520) and, per related disclosures, via the content box in the editor (CVE-2019-13340). Impact per sources is to steal or access user cookies. Roo...
MiniCMS Cross-Site Scripting Vulnerability (CNVD-2018-17188)
MiniCMS is a micro content management system designed for personal websites. A cross-site scripting vulnerability exists in MiniCMS 1.10. An attacker can exploit this vulnerability by using the mc-admin/post-edit.php tags parameter to conduct cross-site scripting attacks...
CVE-2018-16233
MiniCMS V1.10 has XSS via the mc-admin/post-edit.php tags parameter...
CVE-2018-16233
MiniCMS V1.10 has XSS via the mc-admin/post-edit.php tags parameter...
CVE-2018-1000638
MiniCMS version 1.1 contains a Cross Site Scripting XSS vulnerability in http://example.org/mc-admin/page.php?date=payload that can result in code injection...
MiniCMS Information Disclosure Vulnerability (CNVD-2018-08993)
MiniCMS is a mini content management system CMS designed for personal websites. An information disclosure vulnerability exists in the mc-admin/post.php file in MiniCMS version 1.10. A remote attacker can exploit this vulnerability to view all files located in the web root path...
CVE-2018-10296
MiniCMS V1.10 has XSS via the mc-admin/post-edit.php title parameter...
CVE-2018-10227
CVE-2018-10227 affects MiniCMS v1.10. The vulnerability is an XSS flaw in the mc-admin/conf.php site_link parameter, allowing an attacker to inject script through that parameter to execute commands in the user context. No remediation details are provided in the supplied documents. Exploitation st...
CVE-2018-9092
There is a CSRF vulnerability in mc-admin/conf.php in MiniCMS 1.10 that can change the administrator account password...