CVE-2020-19855

phpwcms v1.9 contains a cross-site scripting XSS vulnerability in /imagezoom.php...

CVE-2020-19855

CVE-2020-19855 affects phpwcms v1.9 with a cross-site scripting (XSS) vulnerability in /image_zoom.php. Several connected sources confirm the issue and its impact: an attacker could exploit this XSS to obtain an administrator cookie (CNVD/CNNVD entries). The Red Hat, NVD, and CVE listings all des...

phpwcms 跨站脚本漏洞

phpwcms is a flexible, fast, robust, customer- and developer-friendly and powerful web-based content management system and cms framework based on PHP and MySQL. phpwcms version 1.9 contains a cross-site scripting vulnerability in /imagezoom.php. An attacker can exploit this vulnerability to obtai...

Forced Browsing in slackero/phpwcms

✍️ Description A malicious actor is able to reveal the list and details of newsletter subscribers. 🕵️‍♂️ Proof of Concept - Method 1; This method requires a proxy utility, like BurpSuite. - With an administrator user, create some subscribers on the newsletters under CommunicationNewsletter...

SQL Injection in slackero/phpwcms

✍️ Description Data enters a program from an untrusted source 🕵️‍♂️ Proof of Concept if$result = mysqliquery$db, 'SELECT FROM '. $phpwcms"dbprepend" ? $phpwcms"dbprepend".'' : ''.'phpwcmsuser' 💥 Impact A successful attack may result in the unauthorized viewing of user lists, the deletion of entire...

Cross-site Scripting (XSS) - Stored in slackero/phpwcms

✍️ Description Stored xss 🕵️‍♂️ Proof of Concept Plz check this 1 minute video https://drive.google.com/file/d/1ycKDrN3ot623c-iYTaJYFNCjxCXChNx1/view?usp=sharing 💥 Impact xss bug...

Open Redirect in slackero/phpwcms

✍️ Description Session hijacking via open redirection 🕵️‍♂️ Proof of Concept Steps to reproduce 1. Go to http://your-domain.tld/login.php?ref=http://attackers-domain.tld/? 2. Login to a valid account 3. You will be redirected to...

Arbitrary File Deletion Vulnerability in phpwcms

phpwcms is an open source web content management system. An arbitrary file deletion vulnerability exists in phpwcms, which can be exploited by an attacker to delete files on the server...

File upload vulnerability exists in phpwcms (CNVD-2021-49577)

phpwcms is an open source web content management system. A file upload vulnerability exists in phpwcms, which can be exploited by an attacker to upload a webshell and gain server privileges...

phpwcms code injection vulnerability

phpwcms is an open source Web content management system. It is fast, easy to install and runs on any standard web server platform that supports PHP/MySQL. phpwcms suffers from a code injection vulnerability that can be exploited by attackers via /phpwcms/setup/setup.php...

CVE-2020-21784

phpwcms 1.9.13 is vulnerable to Code Injection via /phpwcms/setup/setup.php...

CVE-2020-21784

phpwcms 1.9.13 is vulnerable to Code Injection via /phpwcms/setup/setup.php...

Code injection

phpwcms 1.9.13 is vulnerable to Code Injection via /phpwcms/setup/setup.php...

CVE-2020-21784

CVE-2020-21784 affects phpwcms 1.9.13 and is described as a Code Injection vulnerability exploitable via the API endpoint /phpwcms/setup/setup.php. The connected sources consistently identify the vulnerable component and path but do not provide concrete exploit steps, affected versions beyond 1.9...

CVE-2020-21784

phpwcms 1.9.13 is vulnerable to Code Injection via /phpwcms/setup/setup.php...

slackero phpwcms 代码注入漏洞

phpwcms is an open source Web content management system. It is fast, easy to install and runs on any standard web server platform that supports PHP/MySQL. phpwcms suffers from a code injection vulnerability that can be exploited by attackers via /phpwcms/setup/setup.php...

PT-2021-10662 · Phpcms · Phpcms

Name of the Vulnerable Software and Affected Versions: phpwcms version 1.9.13 Description: The issue allows for Code Injection via the "/phpwcms/setup/setup.php" API endpoint. Recommendations: For phpwcms version 1.9.13, at the moment, there is no information about a newer version that contains a...

Cross-site scripting vulnerability in phpwcms (CNVD-2018-13849)

phpwcms is an open source web content management system. A vulnerability exists in phpwcms version 1.8.9. A remote attacker can obtain the installation path of a website via an invalid cross-site scripting injection value...

CVE-2018-12990

phpwcms 1.8.9 allows remote attackers to discover the installation path via an invalid csrftokenvalue field...

Code injection

phpwcms 1.8.9 allows remote attackers to discover the installation path via an invalid csrftokenvalue field...