CVE-2023-21317

In ContentService, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitati...

Directory traversal

Multiple directory traversal vulnerabilities in the Default theme in Exero CMS 1.0.1 allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the theme parameter to 1 index.php, 2 editpassword.php, and 3 avatar.php in usercp/; 4 custompage.php; 5...

Exero CMS 1.0.1 (theme) Multiple Local File Inclusion Vulnerabilities

No description provided by source. Exero CMS 1.0.1 theme Multiple Local File Inclusion Vulnerabilities Script : http://switch.dl.sourceforge.net/sourceforge/exerocms/ExeroCMS1-0-1.rar Home Page : http://ecms.getox.net/ POC : /ExeroCMS1-0-1/themes/Default/usercp/index.php?theme=Local File %00...