75 matches found
CVE-2021-4383
The WP Quick FrontEnd Editor plugin for WordPress is vulnerable to page content injection in versions up to, and including, 5.5. This is due to missing capability checks in the plugin's page-editing functionality. This makes it possible for low-authenticated attackers, such as subscribers, to...
SUSE CVE-2008-5250
Cross-site scripting XSS vulnerability in MediaWiki before 1.6.11, 1.12.x before 1.12.2, and 1.13.x before 1.13.3, when Internet Explorer is used and uploads are enabled, or an SVG scripting browser is used and SVG uploads are enabled, allows remote authenticated users to inject arbitrary web...
WordPress theme Bricks 安全漏洞
WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress theme is a theme for WordPress. An authorization issue vulnerability exists in WordPress theme Bricks...
Cross-site Scripting (XSS)
raneto is vulnerable to cross-site scripting. The vulnerability exists in routepageedit function in page.edit.route.js due to improper html escaping on submit of page edit which allows an attacker to inject and execute malicious javascript...
CVE-2022-32007
Complete Online Job Search System v1.0 is vulnerable to SQL Injection via /eris/admin/company/index.php?view=edit&id=...
GHSA-CH37-CH8W-CFRQ Bookstack Cross-site Scripting vulnerability
In BookStack before version 0.30.4, a user with permissions to edit a page could insert JavaScript code through the use of javascript: URIs within a link or form which would run, within the context of the current page, when clicked or submitted. Additionally, a user with permissions to edit a pag...
Fork CMS XSS Vulnerability
Fork CMS 5.0.7 has XSS in /private/en/pages/edit via the title parameter...
MaxSite CMS 跨站脚本漏洞
MaxSite CMS is a web content management system of the Russian MaxSite CMS open source project.MaxSite CMS 108 has a cross-site scripting vulnerability that can be exploited by attackers to perform cross-site scripting attacks via the ftags parameter in /admin/pageedit/3...
CVE-2021-44970
MiniCMS v1.11 was discovered to contain a cross-site scripting XSS vulnerability via /mc-admin/page-edit.php...
CVE-2021-29029
A cross-site scripting XSS vulnerability in Bitweaver version 3.1.0 allows remote attackers to inject JavaScript via the /users/editpersonalpage.php URI...
MiniCMS Directory Traversal Vulnerability (CNVD-2021-02038)
MiniCMS is a micro content management system designed for personal websites. A directory traversal vulnerability exists in pageedit.php in MiniCMS V1.10. A remote attacker can exploit this vulnerability to read arbitrary files via the state parameter...
MiniCMS 路径遍历漏洞
MiniCMS is a micro content management system designed for personal websites. A directory traversal vulnerability exists in pageedit.php in MiniCMS V1.10. A remote attacker can exploit this vulnerability to read arbitrary files via the state parameter...
CVE-2020-26210 Cross-Site Scripting in BookStack
In BookStack before version 0.30.4, a user with permissions to edit a page could add an attached link which would execute untrusted JavaScript code when clicked by a viewer of the page. Dangerous content may remain in the database after this update. If you think this could have been exploited the...
CVE-2020-19887
DBHcms v1.2.0 is affected by a stored XSS vulnerability due to missing htmlspecialchars handling of $_POST['pageparam_insert_description'] in dbhcms/mod/mod.page.edit.php (line 227). An admin-authenticated remote attacker can trigger and hijack other users. The connected sources confirm the vulne...
CVE-2020-19885
DBHcms v1.2.0 has a stored xss vulnerability as there is no htmlspecialchars function for '$POST'pageparaminsertname'' variable in dbhcms\mod\mod.page.edit.php line 227, A remote authenticated with admin user can exploit this vulnerability to hijack other users...
Cross site scripting
The projdoceditpage.php Project Documentation feature in MantisBT before 2.21.3 has a stored cross-site scripting XSS vulnerability, allowing execution of arbitrary code if CSP settings permit it after uploading an attachment with a crafted filename. The code is executed when editing the document...
MiniCMS mc-admin/page-edit.php file cross-site scripting vulnerability
MiniCMS is a content management system CMS designed for personal websites. A cross-site scripting vulnerability exists in the mc-admin/page-edit.php file in MiniCMS version 1.10. The vulnerability stems from the lack of proper validation of client-side data by the WEB application. An attacker can...
CVE-2018-20773
Frog CMS 0.9.5 allows PHP code execution by visiting admin/?/page/edit/1 and inserting additional ?php lines...
Frog CMS Cross-Site Scripting Vulnerability (CNVD-2019-01314)
Frog CMS is a content management system CMS developed by software developer Philippe Archambault. The system provides tools for page templates, user rights management, and document management. A cross-site scripting vulnerability exists in Frog CMS version 0.9.5, which can be exploited by a remot...