CVE-2019-7721

lib/NCCms.class.php in nc-cms 3.5 allows upload of .php files via the index.php?action=save name and editordata parameters...

EUVD-2018-10092

Malware in sbrugna...

EUVD-2019-17253

Malware in sbrugna...

CVE-2018-18874

nc-cms through 2017-03-10 allows remote attackers to execute arbitrary PHP code via the "Upload File or Image" feature, with a .php filename and "Content-Type: application/octet-stream" to the index.php?action=filemanagerupload URI...

CVE-2019-7721

lib/NCCms.class.php in nc-cms 3.5 allows upload of .php files via the index.php?action=save name and editordata parameters...

CVE-2019-7721

lib/NCCms.class.php in nc-cms 3.5 allows upload of .php files via the index.php?action=save name and editordata parameters...

PT-2019-18723

Name of the Vulnerable Software and Affected Versions nc-cms version 3.5 Description The issue allows for the upload of .php files. This is achieved through the index.php?action=save endpoint, utilizing the name and editordata parameters. Recommendations For nc-cms version 3.5, restrict access to...

CVE-2019-7721: Unrestricted Upload of File with Dangerous Type

lib/NCCms.class.php in nc-cms 3.5 allows upload of .php files via the index.php?action=save name and editordata parameters...

CVE-2018-18874

CVE-2018-18874 affects nc-cms up to 2017-03-10. Remote attackers can execute arbitrary PHP code via the Upload File or Image feature when uploading a file named *.php with Content-Type: application/octet-stream to index.php?action=file_manager_upload. The vulnerability description does not specif...

CVE-2018-18874

nc-cms through 2017-03-10 allows remote attackers to execute arbitrary PHP code via the "Upload File or Image" feature, with a .php filename and "Content-Type: application/octet-stream" to the index.php?action=filemanagerupload URI...

PT-2018-14707

Name of the Vulnerable Software and Affected Versions nc-cms versions prior to 2017-03-10 Description The issue allows remote attackers to execute arbitrary PHP code via the "Upload File or Image" feature. This can be achieved by uploading a file with a .php filename and setting the Content-Type ...

CVE-2018-18874: Unrestricted Upload of File with Dangerous Type

nc-cms through 2017-03-10 allows remote attackers to execute arbitrary PHP code via the "Upload File or Image" feature, with a .php filename and "Content-Type: application/octet-stream" to the index.php?action=filemanagerupload URI...

nc-cms cross-site scripting vulnerability (CNVD-2018-21238 )

nc-cms is a PHP-based embeddable lightweight CMS Content Management System. A cross-site scripting vulnerability exists in the index.php?action=edithtml page in nc-cms 2017-03-10 and earlier versions. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML with the...

CVE-2018-18361

An issue was discovered in nc-cms through 2017-03-10. index.php?action=edithtml allows XSS via the name parameter, as demonstrated by a value beginning with homecontent and containing a crafted SRC attribute of an IMG element...

Design/Logic Flaw

An issue was discovered in nc-cms through 2017-03-10. index.php?action=edithtml allows XSS via the name parameter, as demonstrated by a value beginning with homecontent and containing a crafted SRC attribute of an IMG element...

CVE-2018-18361

An issue was discovered in nc-cms through 2017-03-10. index.php?action=edithtml allows XSS via the name parameter, as demonstrated by a value beginning with homecontent and containing a crafted SRC attribute of an IMG element...

CVE-2018-18361

An issue was discovered in nc-cms through 2017-03-10. index.php?action=edithtml allows XSS via the name parameter, as demonstrated by a value beginning with homecontent and containing a crafted SRC attribute of an IMG element...

CVE-2018-18361

An issue was discovered in nc-cms through 2017-03-10. index.php?action=edithtml allows XSS via the name parameter, as demonstrated by a value beginning with homecontent and containing a crafted SRC attribute of an IMG element...

CVE-2018-18361

nc-cms (through 2017-03-10) contains a cross-site scripting (XSS) vulnerability in index.php?action=edit_html where the name parameter can inject arbitrary script/HTML via an IMG SRC attribute. This has been documented in CNVD-2018-21238 and related CVE-2018-18361 records, with exploit details in...

CVE-2018-18361: Improper Neutralization of Input During Web Page Generation

An issue was discovered in nc-cms through 2017-03-10. index.php?action=edithtml allows XSS via the name parameter, as demonstrated by a value beginning with homecontent and containing a crafted SRC attribute of an IMG element...