PT-2023-23754 · Otcms · Otcms

Name of the Vulnerable Software and Affected Versions: OTCMS versions up to 6.62 Description: A critical issue was discovered, affecting unknown code. The manipulation of the username and password arguments with the input admin leads to the use of a hard-coded password. Recommendations: For OTCMS...

PT-2023-23762 · Otcms · Otcms

Name of the Vulnerable Software and Affected Versions: OTCMS versions up to 6.62 Description: A critical issue has been found in OTCMS, affecting the processing of the file /admin/read.php?mudi=getSignal. The manipulation of the signalUrl argument leads to server-side request forgery. This issue...

CVE-2023-1797

A vulnerability classified as critical was found in OTCMS 6.0.1. Affected by this vulnerability is an unknown functionality of the file sysCheckFile.php?mudi=sql. The manipulation leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and m...

Out-of-bounds

A vulnerability classified as critical was found in OTCMS 6.0.1. Affected by this vulnerability is an unknown functionality of the file sysCheckFile.php?mudi=sql. The manipulation leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and m...

CVE-2023-1797 OTCMS unrestricted upload

A vulnerability classified as critical was found in OTCMS 6.0.1. Affected by this vulnerability is an unknown functionality of the file sysCheckFile.php?mudi=sql. The manipulation leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and m...

CVE-2023-1797

Summary: OTCMS 6.0.1 contains a critical vulnerability in the sysCheckFile.php?mudi=sql functionality that allows unrestricted file uploads. The root cause is an absence of upload restrictions in that function, enabling a remote attacker to upload arbitrary files and potentially execute code. The...

CVE-2023-1797: Unrestricted Upload of File with Dangerous Type

A vulnerability classified as critical was found in OTCMS 6.0.1. Affected by this vulnerability is an unknown functionality of the file sysCheckFile.php?mudi=sql. The manipulation leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and m...

PT-2023-2274 · Otcms · Otcms

Name of the Vulnerable Software and Affected Versions: OTCMS version 6.0.1 Description: A critical vulnerability was found in OTCMS, related to the absence of restrictions on file uploads. This issue affects an unknown functionality of the file sysCheckFile.php, where the mudi parameter is set to...

OTCMS code-related vulnerabilities

OTCMS Nettie CMS is an article-based web content management system CMS. A security vulnerability exists in OTCMS version 6.0.1, which originates from an unknown function in the file sysCheckFile.php?mudi=sql, resulting in unrestricted uploads...

CVE-2023-1635

A vulnerability was found in OTCMS 6.72. It has been declared as problematic. Affected by this vulnerability is the function AutoRun of the file apiRun.php. The manipulation of the argument mode leads to cross site scripting. The attack can be launched remotely. The identifier VDB-224017 was...

CVE-2023-1634

A vulnerability was found in OTCMS 6.72. It has been classified as critical. Affected is the function UseCurl of the file /admin/infodeal.php of the component URL Parameter Handler. The manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit ha...

CVE-2023-1634

A vulnerability was found in OTCMS 6.72. It has been classified as critical. Affected is the function UseCurl of the file /admin/infodeal.php of the component URL Parameter Handler. The manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit ha...

CVE-2023-1635

A vulnerability was found in OTCMS 6.72. It has been declared as problematic. Affected by this vulnerability is the function AutoRun of the file apiRun.php. The manipulation of the argument mode leads to cross site scripting. The attack can be launched remotely. The identifier VDB-224017 was...

Server side request forgery (ssrf)

A vulnerability was found in OTCMS 6.72. It has been classified as critical. Affected is the function UseCurl of the file /admin/infodeal.php of the component URL Parameter Handler. The manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit ha...

Cross site scripting

A vulnerability was found in OTCMS 6.72. It has been declared as problematic. Affected by this vulnerability is the function AutoRun of the file apiRun.php. The manipulation of the argument mode leads to cross site scripting. The attack can be launched remotely. The identifier VDB-224017 was...

CVE-2023-1635

CVE-2023-1635 affects OTCMS 6.72. The vulnerability is in the function AutoRun of the file apiRun.php, where manipulating the argument mode leads to a cross-site scripting (XSS) condition. The issue can be exploited remotely (network vector) and requires user interaction to trigger per the report...

CVE-2023-1635 OTCMS apiRun.php AutoRun cross site scripting

A vulnerability was found in OTCMS 6.72. It has been declared as problematic. Affected by this vulnerability is the function AutoRun of the file apiRun.php. The manipulation of the argument mode leads to cross site scripting. The attack can be launched remotely. The identifier VDB-224017 was...

CVE-2023-1635 OTCMS apiRun.php AutoRun cross site scripting

A vulnerability was found in OTCMS 6.72. It has been declared as problematic. Affected by this vulnerability is the function AutoRun of the file apiRun.php. The manipulation of the argument mode leads to cross site scripting. The attack can be launched remotely. The identifier VDB-224017 was...

CVE-2023-1634 OTCMS URL Parameter info_deal.php UseCurl server-side request forgery

A vulnerability was found in OTCMS 6.72. It has been classified as critical. Affected is the function UseCurl of the file /admin/infodeal.php of the component URL Parameter Handler. The manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit ha...

CVE-2023-1634

CVE-2023-1634 affects OTCMS 6.72, specifically the UseCurl function in the URL Parameter Handler (/admin/info_deal.php). The vulnerability enables server-side request forgery (SSRF) and can be exploited remotely; the exploit has been publicly disclosed. Impact is described as high/critical in dif...