111 matches found
Cross site scripting
Stored XSS exists in razorCMS 3.4.8 via the //page description parameter...
CVE-2018-19906
Stored XSS exists in razorCMS 3.4.8 via the //page description parameter...
Cross site scripting
HTML injection exists in razorCMS 3.4.8 via the //page keywords parameter...
CVE-2018-19905
HTML injection exists in razorCMS 3.4.8 via the //page keywords parameter...
CVE-2018-19905
razorCMS 3.4.8 is affected by an HTML injection via the /#/page keywords parameter. The issue concerns the keywords field in that endpoint, enabling arbitrary HTML injection. Remediation hints from PT-2018-15155 suggest restricting access to the /#/page API or stopping use of the keywords paramet...
CVE-2018-19906
Stored XSS exists in razorCMS 3.4.8 via the //page description parameter...
CVE-2018-19906
Stored XSS exists in razorCMS 3.4.8 via the //page description parameter...
CVE-2018-19906
CVE-2018-19906 affects razorCMS 3.4.8. The vulnerability is a Stored XSS via the /#/page endpoint, specifically the description parameter. Root cause is not explicitly detailed beyond the XSS in the description field. Impact is partial integrity impact (per CVSS) with low confidentiality and inte...
CVE-2018-19905
HTML injection exists in razorCMS 3.4.8 via the //page keywords parameter...
CVE-2018-19905
HTML injection exists in razorCMS 3.4.8 via the //page keywords parameter...
PT-2018-15155 · Razorcms · Razorcms
Name of the Vulnerable Software and Affected Versions: razorCMS version 3.4.8 Description: The issue is related to HTML injection in the software. It can be exploited via the "//page" API endpoint, specifically through the keywords parameter. Recommendations: For razorCMS version 3.4.8, consider...
PT-2018-15156 · Razorcms · Razorcms
Name of the Vulnerable Software and Affected Versions: razorCMS version 3.4.8 Description: A stored XSS issue exists, allowing potential exploitation via the //page API endpoint, specifically through the description parameter. Recommendations: For razorCMS version 3.4.8, update to a version that...
razorCMS Cross-Site Request Forgery Vulnerability (CNVD-2018-26701)
razorCMS is an open source content management system written in PHP, which stores all data in flat files, so there is no need to install a database. A cross-site request forgery vulnerability exists in the rars/user/data page in razorCMS version 3.4.8. A remote attacker can exploit this...
CVE-2018-17986
rars/user/data in razorCMS 3.4.8 allows CSRF for changing the password of an admin user...
CVE-2018-17986
rars/user/data in razorCMS 3.4.8 allows CSRF for changing the password of an admin user...
CVE-2018-17986
rars/user/data in razorCMS 3.4.8 allows CSRF for changing the password of an admin user...
CVE-2018-17986
CVE-2018-17986 affects razorCMS 3.4.8. The vulnerability is a Cross-Site Request Forgery (CSRF) in the rars/user/data page that allows changing the password of an admin user. No exploitation details are provided in the connected documents. Impact is described by multiple sources as enabling passw...
razorCMS HTML Injection Vulnerability
razorCMS is an open source content management system written in PHP, which stores all data in flat files, so there is no need to install a database. An HTML injection vulnerability exists in razorCMS version 3.4.7, which can be exploited by attackers to execute malicious code...
razorCMS Settings Component Cross-Site Scripting Vulnerability
razorCMS is an open source content management system written in PHP, which stores all data in flat files, so there is no need to install a database. A cross-site scripting vulnerability exists in the Settings component of razorCMS version 3.4.7, which can be exploited by a remote attacker to...