CVE-2018-16370

CVE-2018-16370 In PESCMS Team 2.2.1, attackers may upload and execute arbitrary PHP code through /Public/?g=Team&m=Setting&a=upgrade by placing a .php file in a ZIP archive.More details see https://github.com/lazyphp/PESCMS-TEAM/issues/2...

CVE-2021-31677

An issue was discovered in PESCMS-V2.3.3. There is a CSRF vulnerability that can modify admin and other members' passwords...

CVE-2021-31678

An issue was discovered in PESCMS-V2.3.3. There is a CSRF vulnerability that can delete import information about a user's company...

CVE-2021-31676

A reflected XSS was discovered in PESCMS-V2.3.3. When combined with CSRF in the same file, they can cause bigger destruction...

EUVD-2018-8216

Malware in sbrugna...

EUVD-2020-20579

Malware in sbrugna...

EUVD-2021-18562

Malware in sbrugna...

EUVD-2021-18564

Malware in sbrugna...

EUVD-2021-18565

Malware in sbrugna...

EUVD-2021-18563

Malware in sbrugna...

EUVD-2024-28870

Malicious code in bioql PyPI...

CVE-2024-30952

A stored cross-site scripting XSS vulnerability in PESCMS-TEAM v2.3.6 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the domain input field under /youdoamin/?g=Team=Setting=action...

CVE-2021-31679

An issue was discovered in PESCMS-V2.3.3. There is a CSRF vulnerability that allows attackers to delete admin and other members' account numbers...

CVE-2020-28092

PESCMS Team 2.3.2 has multiple reflected XSS via the id parameter:?g=Team=Task=my=3=,?g=Team=Task=my=0=,?g=Team=Task=my=1=,?g=Team=Task=my=10=...

CVE-2024-30952

A stored cross-site scripting XSS vulnerability in PESCMS-TEAM v2.3.6 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the domain input field under /youdoamin/?g=Team&m=Setting&a=action...

CVE-2024-30952

The content publishing platform PESCMS-TEAM v2.3.6 is vulnerable to a stored cross-site scripting (XSS) vulnerability. The issue originates from the youdoamin component, where a lack of proper input neutralization allows an attacker to inject a crafted payload into the domain input field at the /...

CVE-2024-30952

A stored cross-site scripting XSS vulnerability in PESCMS-TEAM v2.3.6 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the domain input field under /youdoamin/?g=Team&m=Setting&a=action...

CVE-2024-30952: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting XSS vulnerability in PESCMS-TEAM v2.3.6 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the domain input field under /youdoamin/?g=Team&m=Setting&a=action...

PESCMS security vulnerabilities

PESCMS is a content publishing platform. A security vulnerability exists in PESCMS-TEAM version v2.3.6, which stems from a stored cross-site scripting XSS vulnerability in component/youdoamin. An attacker can exploit the vulnerability to execute arbitrary web script or HTML code by injecting a...

PESCMS cross-site scripting vulnerability

A cross-site scripting vulnerability exists in PESCMS version V2.3.3, a content publishing platform. The vulnerability stems from App/Team/GET/Report.php missing a data validation filter for user-supplied data and output. An attacker could exploit the vulnerability to execute JavaScript code on t...