CVE-2021-37394

In RPCMS v1.8 and below, attackers can interact with API and change variable "role" to "admin" to achieve admin user registration...

CVE-2021-37392

In RPCMS v1.8 and below, the "nickname" variable is not properly sanitized before being displayed on page. When the API functions are enabled, the attacker can use API to update user nickname with XSS payload and achieve stored XSS. Users who view the articles published by the injected user will...

Cross site scripting

In RPCMS v1.8 and below, the "nickname" variable is not properly sanitized before being displayed on page. When the API functions are enabled, the attacker can use API to update user nickname with XSS payload and achieve stored XSS. Users who view the articles published by the injected user will...

Cross site scripting

In RPCMS v1.8 and below, the "nickname" variable is not properly sanitized before being displayed on page. Attacker can use "update password" function to inject XSS payloads into nickname variable, and achieve stored XSS. Users who view the articles published by the injected user will trigger the...

CVE-2021-37394

In RPCMS v1.8 and below, attackers can interact with API and change variable "role" to "admin" to achieve admin user registration...

CVE-2021-37394

In RPCMS v1.8 and below, attackers can interact with API and change variable "role" to "admin" to achieve admin user registration...

CVE-2021-37394

RPCMS (v1.8 and earlier) contains an API-level flaw that allows attackers to alter the user role parameter to admin via the API, enabling admin account registration. The connected sources consistently describe this as a role-parameter manipulation vulnerability affecting RPCMS v1.8 and below, lea...

CVE-2021-37393

In RPCMS v1.8 and below, the "nickname" variable is not properly sanitized before being displayed on page. Attacker can use "update password" function to inject XSS payloads into nickname variable, and achieve stored XSS. Users who view the articles published by the injected user will trigger the...

CVE-2021-37393

In RPCMS v1.8 and below, the "nickname" variable is not properly sanitized before being displayed on page. Attacker can use "update password" function to inject XSS payloads into nickname variable, and achieve stored XSS. Users who view the articles published by the injected user will trigger the...

CVE-2021-37393

CVE-2021-37393 affects RPCMS v1.8 and earlier: the nickname variable is not sanitized before display, enabling stored XSS via the update password function. Users viewing articles by the injected user trigger the XSS. No remediation/fix details are provided in the connected documents.

CVE-2021-37392

Summary: CVE-2021-37392 affects RPCMS v1.8 and earlier. The nickname field is not properly sanitized before display, enabling stored XSS when API functionality is enabled and an attacker updates a user nickname with an XSS payload; victims viewing articles by the injected user may trigger the XSS...

CVE-2021-37392

In RPCMS v1.8 and below, the "nickname" variable is not properly sanitized before being displayed on page. When the API functions are enabled, the attacker can use API to update user nickname with XSS payload and achieve stored XSS. Users who view the articles published by the injected user will...

CVE-2021-37392

In RPCMS v1.8 and below, the "nickname" variable is not properly sanitized before being displayed on page. When the API functions are enabled, the attacker can use API to update user nickname with XSS payload and achieve stored XSS. Users who view the articles published by the injected user will...

RPCMS 安全漏洞

RPCMS is a software application. A website CMS system. A security vulnerability exists in RPCMS, which originates in RPCMS v1.8 and below, that can be exploited by an attacker to interact with the API to change the variable "role" to "admin" for administrator user registration...

PT-2021-21631

Name of the Vulnerable Software and Affected Versions RPCMS versions 1.8 and below Description The issue arises from the improper sanitization of the nickname variable before it is displayed on a page. When API functions are enabled, an attacker can exploit this by updating a user's nickname with...

CVE-2021-37393: Improper Neutralization of Input During Web Page Generation

In RPCMS v1.8 and below, the "nickname" variable is not properly sanitized before being displayed on page. Attacker can use "update password" function to inject XSS payloads into nickname variable, and achieve stored XSS. Users who view the articles published by the injected user will trigger the...

CVE-2021-37394: Undefined Security Weakness

In RPCMS v1.8 and below, attackers can interact with API and change variable "role" to "admin" to achieve admin user registration...

CVE-2021-37392: Improper Neutralization of Input During Web Page Generation

In RPCMS v1.8 and below, the "nickname" variable is not properly sanitized before being displayed on page. When the API functions are enabled, the attacker can use API to update user nickname with XSS payload and achieve stored XSS. Users who view the articles published by the injected user will...

PT-2021-21632

Name of the Vulnerable Software and Affected Versions RPCMS versions 1.8 and below Description The issue arises from the nickname variable not being properly sanitized before being displayed on a page. An attacker can exploit this by using the update password function to inject XSS payloads into...

PT-2021-21633

Name of the Vulnerable Software and Affected Versions RPCMS versions 1.8 and below Description The issue allows attackers to interact with the API and change the role variable to admin, achieving admin user registration. Recommendations For RPCMS versions 1.8 and below, as a temporary workaround,...