CVE-2010-5051

The CVE-2010-5051 entry describes a Cross-Site Scripting (XSS) vulnerability in razorCMS 1.0 stable, specifically in admin/core/admin_func.php where the content parameter used in an edit action to admin/index.php can be exploited to inject arbitrary script/HTML. This is triggered via crafted inpu...

CVE-2010-5051

Cross-site scripting XSS vulnerability in admin/core/adminfunc.php in razorCMS 1.0 stable allows remote attackers to inject arbitrary web script or HTML via the content parameter in an edit action to admin/index.php...

RazorCMS 1.0 - adminindex.php HTML Injection

RazorCMS 1.0 - adminindex.php HTML Injection source: https://www.securityfocus.com/bid/40373/info razorCMS is prone to an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied data. Attacker-supplied HTML or JavaScript code could run in the context of the affected...

RazorCMS 1.0 - '/admin/index.php' HTML Injection

source: https://www.securityfocus.com/bid/40373/info razorCMS is prone to an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied data. Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to ste...

Cross-site Scripting Vulnerability in razorCMS

High-Tech Bridge SA Security Research Lab has discovered vulnerability in razorCMS which could be exploited to perform cross-site scripting attacks. 1 Cross-site scripting XSS vulnerability in razorCMS: CVE-2010-5051 The vulnerability exists due to input sanitation error in the "content" paramete...

CVE-2009-1462

The Security Manager in razorCMS before 0.4 does not verify the permissions of every file owned by the apache user account, which is inconsistent with the documentation and allows local users to have an unspecified impact...

CVE-2009-1463

Static code injection vulnerability in razorCMS before 0.4 allows remote attackers to inject arbitrary PHP code into any page by saving content as a .php file...

CVE-2009-1461

Cross-site scripting XSS vulnerability in the Create New Page form in razorCMS 0.3 RC2 and earlier allows remote authenticated users to inject arbitrary web script or HTML via the Page Title field...

CVE-2009-1459

Cross-site request forgery CSRF vulnerability in razorCMS before 0.4 allows remote attackers to hijack the authentication of administrators for requests that create a web page containing PHP code...

CVE-2009-1460

razorCMS before 0.4 uses weak permissions for 1 admin/core/adminconfig.php, which allows local users to obtain the administrator's password hash and FTP user credentials; and 2 the root directory, 3 datastore/, and 4 admin/core/, which allows local users to have an unspecified impact...

CVE-2009-1458

Multiple cross-site scripting XSS vulnerabilities in admin/index.php in razorCMS before 0.4 allow remote attackers to inject arbitrary web script or HTML via 1 the slab parameter in an edit action, 2 the catname parameter in a showcats action, and 3 the cat parameter in a reordercat action...

Code injection

Static code injection vulnerability in razorCMS before 0.4 allows remote attackers to inject arbitrary PHP code into any page by saving content as a .php file...

Cross site scripting

Cross-site scripting XSS vulnerability in the Create New Page form in razorCMS 0.3 RC2 and earlier allows remote authenticated users to inject arbitrary web script or HTML via the Page Title field...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in razorCMS before 0.4 allows remote attackers to hijack the authentication of administrators for requests that create a web page containing PHP code...

Design/Logic Flaw

The Security Manager in razorCMS before 0.4 does not verify the permissions of every file owned by the apache user account, which is inconsistent with the documentation and allows local users to have an unspecified impact...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in admin/index.php in razorCMS before 0.4 allow remote attackers to inject arbitrary web script or HTML via 1 the slab parameter in an edit action, 2 the catname parameter in a showcats action, and 3 the cat parameter in a reordercat action...

CVE-2009-1458

CVE-2009-1458 affects razorCMS prior to 0.4. The admin/index.php file contains multiple XSS flaws that allow remote attackers to inject arbitrary web script or HTML via (1) slab in the edit action, (2) catname in showcats, and (3) cat in reordercat. Impact is web-script/HTML injection without use...

CVE-2009-1459

Cross-site request forgery CSRF vulnerability in razorCMS before 0.4 allows remote attackers to hijack the authentication of administrators for requests that create a web page containing PHP code...

CVE-2009-1463

Static code injection vulnerability in razorCMS before 0.4 allows remote attackers to inject arbitrary PHP code into any page by saving content as a .php file...

CVE-2009-1461

Cross-site scripting XSS vulnerability in the Create New Page form in razorCMS 0.3 RC2 and earlier allows remote authenticated users to inject arbitrary web script or HTML via the Page Title field...