CVE-2023-51049

CVE-2023-51049 : S-CMS v5.0 has a SQL injection vulnerability via the A_bbsauth parameter in /admin/ajax.php. This is a high-severity issue (CVSS v3.1: 9.8, CRITICAL) with network access, no authentication, no user interaction, and impacts to confidentiality, integrity, and availability. Root cau...

CVE-2023-51048

CVE-2023-51048 affects S-CMS v5.0 with a SQL injection via the A_newsauth parameter in /admin/ajax.php. Root cause: unsanitized input leading to SQL injection. Impact per sources: high confidentiality, integrity, and availability; attack vector is network with no authentication and no user intera...

CVE-2023-51052

CVE-2023-51052 affects S-CMS v5.0, with a SQL injection vulnerability in the A_formauth parameter of /admin/ajax.php. Root cause: unsafely handling user input in A_formauth allows constructing malicious SQL. Impact per CVSS 3.1: Confidentiality/Integrity/Availability: High; Base score 9.8 (CRITIC...

CVE-2023-51051

S-CMS v5.0 contains a SQL injection vulnerability via the A_textauth parameter in /admin/ajax.php. CVSS v3.1 base score 9.8 (CRITICAL) with network access, no privileges, no user interaction. Affected component: A_textauth handling in /admin/ajax.php; impact on confidentiality, integrity, and ava...

CVE-2023-29963

S-CMS v5.0 was discovered to contain an authenticated remote code execution RCE vulnerability via the component /admin/ajax.php...

CVE-2023-29963

S-CMS v5.0 was discovered to contain an authenticated remote code execution RCE vulnerability via the component /admin/ajax.php...

Remote code execution

S-CMS v5.0 was discovered to contain an authenticated remote code execution RCE vulnerability via the component /admin/ajax.php...

CVE-2023-29963

S-CMS v5.0 was discovered to contain an authenticated remote code execution RCE vulnerability via the component /admin/ajax.php...

CVE-2023-29963

S-CMS v5.0 was discovered to contain an authenticated remote code execution RCE vulnerability via the component /admin/ajax.php...

CVE-2023-29963

S-CMS v5.0 contains an authenticated remote code execution (RCE) vulnerability in the /admin/ajax.php endpoint. CVSS v3.1 indicates Network access, high impact to confidentiality, integrity, and availability (base score 7.2). Exploit details are not provided beyond the authenticated RCE via this ...

CVE-2022-4377

A vulnerability was found in S-CMS 5.0 Build 20220328. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component Contact Information Page. The manipulation of the argument Make a Call leads to cross site scripting. The attack can be launched...

CVE-2022-4377

A vulnerability was found in S-CMS 5.0 Build 20220328. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component Contact Information Page. The manipulation of the argument Make a Call leads to cross site scripting. The attack can be launched...

Cross site scripting

A vulnerability was found in S-CMS 5.0 Build 20220328. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component Contact Information Page. The manipulation of the argument Make a Call leads to cross site scripting. The attack can be launched...

CVE-2022-4377 S-CMS Contact Information Page cross site scripting

A vulnerability was found in S-CMS 5.0 Build 20220328. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component Contact Information Page. The manipulation of the argument Make a Call leads to cross site scripting. The attack can be launched...

S-CMS 跨站脚本漏洞

S-CMS is a PHP and MySQL based Content Management System CMS from S-CMS China. A security vulnerability exists in S-CMS version 5.0 Build 20220328. An attacker can exploit the vulnerability to perform cross-site scripting attacks...

CVE-2022-4377

CVE-2022-4377 affects S-CMS 5.0 Build 20220328. The vulnerability is a Cross-Site Scripting (XSS) in the Contact Information Page, triggered by manipulating the Make a Call argument. Exploitation can be performed remotely and the exploit has been disclosed publicly. Several connected sources reit...

CVE-2022-4377 S-CMS Contact Information Page cross site scripting

A vulnerability was found in S-CMS 5.0 Build 20220328. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component Contact Information Page. The manipulation of the argument Make a Call leads to cross site scripting. The attack can be launched...

CVE-2022-23336

S-CMS v5.0 was discovered to contain a SQL injection vulnerability in memberpay.php via the Oid parameter...

CVE-2022-23336

S-CMS v5.0 was discovered to contain a SQL injection vulnerability in memberpay.php via the Oid parameter...

CVE-2022-23336

S-CMS v5.0 was discovered to contain a SQL injection vulnerability in memberpay.php via the Oid parameter...