CVE-2020-17551

ImpressCMS 1.4.0 is affected by XSS in modules/system/admin.php which may result in arbitrary remote code execution...

CVE-2020-17551: Improper Neutralization of Input During Web Page Generation

ImpressCMS 1.4.0 is affected by XSS in modules/system/admin.php which may result in arbitrary remote code execution...

PT-2020-15037

Name of the Vulnerable Software and Affected Versions ImpressCMS version 1.4.0 Description The issue concerns a potential XSS in the modules/system/admin.php file, which could lead to arbitrary remote code execution. Recommendations For ImpressCMS version 1.4.0, consider restricting access to the...

CVE-2014-4036: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in modules/system/admin.php in ImpressCMS 1.3.6.1 allows remote attackers to inject arbitrary web script or HTML via the query parameter in a listimg action...

PT-2014-5688

Name of the Vulnerable Software and Affected Versions ImpressCMS version 1.3.6.1 Description A cross-site scripting XSS issue exists in the modules/system/admin.php file, allowing remote attackers to inject arbitrary web script or HTML via the query parameter in a "listimg" action. This could...

CVE-2008-6360

Cross-site scripting XSS vulnerability in the userranks feature in modules/system/admin.php in ImpressCMS 1.0.2 final allows remote attackers to inject arbitrary web script or HTML via the ranktitle parameter. NOTE: some of these details are obtained from third party information...

CVE-2008-6360: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the userranks feature in modules/system/admin.php in ImpressCMS 1.0.2 final allows remote attackers to inject arbitrary web script or HTML via the ranktitle parameter. NOTE: some of these details are obtained from third party information...

CVE-2008-3296: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in modules/system/admin.php in XOOPS 2.0.18 1 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the fct parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party...

CVE-2008-3295: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in modules/system/admin.php in XOOPS 2.0.18.1 allows remote attackers to inject arbitrary web script or HTML via the fct parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2007-6548: Improper Control of Generation of Code

Multiple direct static code injection vulnerabilities in RunCMS before 1.6.1 allow remote authenticated administrators to inject arbitrary PHP code via the 1 header and 2 footer parameters to modules/system/admin.php in a meta-generator action, 3 the disclaimer parameter to modules/system/admin.p...