CVE-2022-50944

Aero CMS 0.0.1 is affected by a PHP code injection vulnerability. Authenticated attackers can upload PHP files via the image parameter to the admin posts.php endpoint with source=add_post, leading to server-side code execution. The vulnerability exposes high impact on confidentiality, integrity, ...

CVE-2022-50944: Improper Control of Generation of Code

Aero CMS 0.0.1 contains a PHP code injection vulnerability that allows authenticated attackers to execute arbitrary PHP code by uploading malicious files through the image parameter. Attackers can upload PHP files with embedded code to the admin posts.php endpoint with source=addpost parameter, a...

CVE-2026-4666: Missing Authorization

The wpForo Forum plugin for WordPress is vulnerable to unauthorized modification of data due to the use of extract$args, EXTROVERWRITE on user-controlled input in the edit method of classes/Posts.php in all versions up to, and including, 2.4.16. The postedit action handler in Actions.php passes...

CVE-2018-25199: Improper Neutralization of Special Elements used in an SQL Command

OOP CMS BLOG 1.0 contains SQL injection vulnerabilities that allow unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through multiple parameters. Attackers can inject SQL commands via the search parameter in search.php, pageid parameter in page.php, and id...

EUVD-2006-0163

Malware in sbrugna...

CVE-2025-5406

The CVE-2025-5406 entry affects chaitak-gorai Blogbook (up to commit 92f5cf90f8a7e6566b576fe0952e14e1c6736513). The vulnerability resides in an unknown function within /admin/posts.php?source=add_post, where manipulating the image parameter leads to unrestricted file upload. This remote attack is...

CVE-2025-5406: Unrestricted Upload of File with Dangerous Type

A vulnerability, which was classified as critical, was found in chaitak-gorai Blogbook up to 92f5cf90f8a7e6566b576fe0952e14e1c6736513. Affected is an unknown function of the file /admin/posts.php?source=addpost. The manipulation of the argument image leads to unrestricted upload. It is possible t...

PT-2025-23433 · Unknown · Chaitak-Gorai Blogbook

Name of the Vulnerable Software and Affected Versions: chaitak-gorai Blogbook up to 92f5cf90f8a7e6566b576fe0952e14e1c6736513 Description: A critical vulnerability was found in chaitak-gorai Blogbook. The issue affects an unknown function of the file /admin/posts.php?source=add post, where the...

CVE-2023-5811 flusity CMS posts.php loadPostAddForm cross site scripting

A vulnerability, which was classified as problematic, was found in flusity CMS. Affected is the function loadPostAddForm of the file core/tools/posts.php. The manipulation of the argument menuid leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been...

CVE-2023-5810 flusity CMS posts.php loadPostAddForm cross site scripting

A vulnerability, which was classified as problematic, has been found in flusity CMS. This issue affects the function loadPostAddForm of the file core/tools/posts.php. The manipulation of the argument editpostid leads to cross site scripting. The attack may be initiated remotely. The exploit has...

CVE-2023-5810 flusity CMS posts.php loadPostAddForm cross site scripting

A vulnerability, which was classified as problematic, has been found in flusity CMS. This issue affects the function loadPostAddForm of the file core/tools/posts.php. The manipulation of the argument editpostid leads to cross site scripting. The attack may be initiated remotely. The exploit has...

CVE-2023-5811: Improper Neutralization of Input During Web Page Generation

A vulnerability, which was classified as problematic, was found in flusity CMS. Affected is the function loadPostAddForm of the file core/tools/posts.php. The manipulation of the argument menuid leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been...

CVE-2023-5810: Improper Neutralization of Input During Web Page Generation

A vulnerability, which was classified as problematic, has been found in flusity CMS. This issue affects the function loadPostAddForm of the file core/tools/posts.php. The manipulation of the argument editpostid leads to cross site scripting. The attack may be initiated remotely. The exploit has...

CVE-2022-46135: Unrestricted Upload of File with Dangerous Type

In AeroCms v0.0.1, there is an arbitrary file upload vulnerability at /admin/posts.php?source=editpost , through which we can upload webshell and control the web server...

CVE-2022-28422

The CVE-2022-28422 entry concerns Baby Care System v1.0, which is vulnerable to a SQL injection in the administrative interface. Specifically, the weakness is exposed via /admin/posts.php&action=edit (per multiple sources, e.g., NVD entries and CNVD/CVE records). The root cause is an injectable S...

CVE-2022-28424

CVE-2022-28424 affects Baby Care System v1.0, with a SQL injection vulnerability in /admin/posts.php&find= that arises from unvalidated external input. The root cause is improper handling of the find parameter, enabling arbitrary SQL execution. Impact is stated by the CVSS data: CVSSv2 base score...

CVE-2022-28422: Improper Neutralization of Special Elements used in an SQL Command

Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/posts.php&action=edit...

CVE-2022-28423: Improper Neutralization of Special Elements used in an SQL Command

Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/posts.php&action=delete...

CVE-2022-28424: Improper Neutralization of Special Elements used in an SQL Command

Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/posts.php&find=...

Cross-Site Request Forgery (CSRF)

anchorcms/anchor-cms is vulnerable to cross-site request forgery. The vulnerability exists because the token is not checked when deleting the posts in posts.php which allows an attacker to arbitrarily delete the posts...