237 matches found
PT-2023-12406 · Slackero · Phpcms
Name of the Vulnerable Software and Affected Versions: slackero phpwcms versions up to 1.9.26 Description: A vulnerability was found in the SVG File Handler component of slackero phpwcms, which can be exploited to lead to cross site scripting. The manipulation can be initiated remotely...
CVE-2021-4302: Improper Neutralization of Input During Web Page Generation
A vulnerability was found in slackero phpwcms up to 1.9.26. It has been classified as problematic. This affects an unknown part of the component SVG File Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 1.9.27 is able to...
Phpwcms 1.9.30 Cross Site Scripting
Exploit Title: Phpwcms 1.9.30 - File Upload to XSS Date: 30/9/2021 Exploit Author: Okan Kurtulus | okankurtulus.com.tr Software Link: http://www.phpwcms.org/ Version: 1.9.30 Tested on: Ubuntu 16.04 Steps: 1- You need to login to the system. http://target.com/phpwcms/login.php 2- Creating payload...
Phpwcms 1.9.30 - File Upload to XSS Vulnerability
Exploit Title: Phpwcms 1.9.30 - File Upload to XSS Exploit Author: Okan Kurtulus | okankurtulus.com.tr Software Link: http://www.phpwcms.org/ Version: 1.9.30 Tested on: Ubuntu 16.04 Steps: 1- You need to login to the system. http://target.com/phpwcms/login.php 2- Creating payload with SVG...
CVE-2020-19855
phpwcms v1.9 contains a cross-site scripting XSS vulnerability in /imagezoom.php...
CVE-2020-19855
phpwcms v1.9 contains a cross-site scripting XSS vulnerability in /imagezoom.php...
Cross site scripting
phpwcms v1.9 contains a cross-site scripting XSS vulnerability in /imagezoom.php...
phpwcms Cross-Site Scripting Vulnerability (CNVD-2021-93900)
phpwcms is a flexible, fast, robust, customer- and developer-friendly and powerful web-based content management system and cms framework based on PHP and MySQL. phpwcms version 1.9 contains a cross-site scripting vulnerability in /imagezoom.php. An attacker can exploit this vulnerability to obtai...
CVE-2020-19855
CVE-2020-19855 affects phpwcms v1.9 with a cross-site scripting (XSS) vulnerability in /image_zoom.php. Several connected sources confirm the issue and its impact: an attacker could exploit this XSS to obtain an administrator cookie (CNVD/CNNVD entries). The Red Hat, NVD, and CVE listings all des...
CVE-2020-19855
phpwcms v1.9 contains a cross-site scripting XSS vulnerability in /imagezoom.php...
phpwcms 跨站脚本漏洞
phpwcms is a flexible, fast, robust, customer- and developer-friendly and powerful web-based content management system and cms framework based on PHP and MySQL. phpwcms version 1.9 contains a cross-site scripting vulnerability in /imagezoom.php. An attacker can exploit this vulnerability to obtai...
CVE-2020-19855: Improper Neutralization of Input During Web Page Generation
phpwcms v1.9 contains a cross-site scripting XSS vulnerability in /imagezoom.php...
Forced Browsing in slackero/phpwcms
✍️ Description A malicious actor is able to reveal the list and details of newsletter subscribers. 🕵️♂️ Proof of Concept - Method 1; This method requires a proxy utility, like BurpSuite. - With an administrator user, create some subscribers on the newsletters under CommunicationNewsletter...
SQL Injection in slackero/phpwcms
✍️ Description Data enters a program from an untrusted source 🕵️♂️ Proof of Concept if$result = mysqliquery$db, 'SELECT FROM '. $phpwcms"dbprepend" ? $phpwcms"dbprepend".'' : ''.'phpwcmsuser' 💥 Impact A successful attack may result in the unauthorized viewing of user lists, the deletion of entire...
Cross-site Scripting (XSS) - Stored in slackero/phpwcms
✍️ Description Stored xss 🕵️♂️ Proof of Concept Plz check this 1 minute video https://drive.google.com/file/d/1ycKDrN3ot623c-iYTaJYFNCjxCXChNx1/view?usp=sharing 💥 Impact xss bug...
Open Redirect in slackero/phpwcms
✍️ Description Session hijacking via open redirection 🕵️♂️ Proof of Concept Steps to reproduce 1. Go to http://your-domain.tld/login.php?ref=http://attackers-domain.tld/? 2. Login to a valid account 3. You will be redirected to...
Arbitrary File Deletion Vulnerability in phpwcms
phpwcms is an open source web content management system. An arbitrary file deletion vulnerability exists in phpwcms, which can be exploited by an attacker to delete files on the server...
File upload vulnerability exists in phpwcms (CNVD-2021-49577)
phpwcms is an open source web content management system. A file upload vulnerability exists in phpwcms, which can be exploited by an attacker to upload a webshell and gain server privileges...
phpwcms code injection vulnerability
phpwcms is an open source Web content management system. It is fast, easy to install and runs on any standard web server platform that supports PHP/MySQL. phpwcms suffers from a code injection vulnerability that can be exploited by attackers via /phpwcms/setup/setup.php...