90 matches found
CVE-2022-41475
RPCMS v3.0.2 was discovered to contain a Cross-Site Request Forgery CSRF which allows attackers to arbitrarily add an administrator account...
CVE-2022-41475
RPCMS v3.0.2 is affected by a Cross-Site Forgery (CSRF) vulnerability that allows attackers to arbitrarily add an administrator account. The incident is documented across multiple sources (NVD CVE-2022-41475, Red Hat, PRion, CNNVD, CVE listings) with a common description. The CVSS v3.1 base score...
CVE-2022-41474: Cross-Site Request Forgery (CSRF)
RPCMS v3.0.2 was discovered to contain a Cross-Site Request Forgery CSRF which allows attackers to arbitrarily change the password of any account...
CVE-2022-41473
RPCMS 3.0.2 contains a reflected Cross-Site Scripting (XSS) vulnerability in the Search function. An attacker can inject arbitrary script in the victim’s browser, potentially stealing cookie-based credentials and enabling additional browser-based attacks. Affected product: RPCMS 3.0.2; vulnerabil...
CVE-2022-41473
RPCMS v3.0.2 was discovered to contain a reflected cross-site scripting XSS vulnerability in the Search function...
PT-2022-25880 · Rpcms · Rpcms
Name of the Vulnerable Software and Affected Versions: RPCMS version 3.0.2 Description: A reflected cross-site scripting XSS issue was found in the Search function. This could potentially allow an attacker to inject malicious scripts into the website. Recommendations: For RPCMS version 3.0.2,...
RPCMS 跨站脚本漏洞
RPCMS is a software application. A website CMS system. A security vulnerability exists in RPCMS version v3.0.2 that stems from the inclusion of reflected cross-site scripting XSS in the search function...
CVE-2022-41473
RPCMS v3.0.2 was discovered to contain a reflected cross-site scripting XSS vulnerability in the Search function...
PT-2022-25882
Name of the Vulnerable Software and Affected Versions RPCMS version 3.0.2 Description The issue allows attackers to arbitrarily add an administrator account due to a Cross-Site Request Forgery CSRF. This can be exploited by attackers to gain unauthorized access to the system. Recommendations For...
SQL Injection Vulnerability in RPCMS (CNVD-2022-64528)
RPCMS is a lightweight content management/blogging system based on PHP MYSQL. RPCMS suffers from a SQL injection vulnerability. An attacker can exploit the vulnerability to obtain sensitive database information...
SQL injection vulnerability exists in RPCMS (CNVD-2022-61944)
RPCMS is a lightweight content management/blogging system based on PHP MYSQL.RPCMS is vulnerable to SQL injection, which can be exploited by attackers to obtain sensitive database information...
SQL injection vulnerability exists in RPCMS (CNVD-2022-64953)
RPCMS is a lightweight content management/blogging system based on PHP MYSQL.RPCMS is vulnerable to SQL injection, which can be exploited by attackers to obtain sensitive database information...
RPCMS has information leakage vulnerability
RPCMS is a lightweight content management/blogging system based on PHP MYSQL.RPCMS has an information disclosure vulnerability that can be exploited by attackers to obtain sensitive information...
RPCMS Cross-Site Scripting Vulnerability (CNVD-2021-61418)
RPCMS is a software application, a web CMS system. RPCMS suffers from a cross-site scripting vulnerability that stems from a failure to properly clean up the nickname variable before it is displayed on a page in RPCMS v1.8 versions and below. With the API functionality turned on, an attacker can...
CVE-2021-37392
In RPCMS v1.8 and below, the "nickname" variable is not properly sanitized before being displayed on page. When the API functions are enabled, the attacker can use API to update user nickname with XSS payload and achieve stored XSS. Users who view the articles published by the injected user will...
CVE-2021-37392
In RPCMS v1.8 and below, the "nickname" variable is not properly sanitized before being displayed on page. When the API functions are enabled, the attacker can use API to update user nickname with XSS payload and achieve stored XSS. Users who view the articles published by the injected user will...
CVE-2021-37393
In RPCMS v1.8 and below, the "nickname" variable is not properly sanitized before being displayed on page. Attacker can use "update password" function to inject XSS payloads into nickname variable, and achieve stored XSS. Users who view the articles published by the injected user will trigger the...
CVE-2021-37394
In RPCMS v1.8 and below, attackers can interact with API and change variable "role" to "admin" to achieve admin user registration...
CVE-2021-37393
In RPCMS v1.8 and below, the "nickname" variable is not properly sanitized before being displayed on page. Attacker can use "update password" function to inject XSS payloads into nickname variable, and achieve stored XSS. Users who view the articles published by the injected user will trigger the...
